Bug#991041: libcommons-compress-java: CVE-2021-36090 CVE-2021-35517 CVE-2021-35516 CVE-2021-35515

[Moritz Mühlenhoff]

Source: libcommons-compress-java
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerabilities were published for libcommons-compress-java.

CVE-2021-36090[0]:
| When reading a specially crafted ZIP archive, Compress can be made to
| allocate large amounts of memory that finally leads to an out of
| memory error even for very small inputs. This could be used to mount a
| denial of service attack against services that use Compress' zip
| package.

https://www.openwall.com/lists/oss-security/2021/07/13/4


CVE-2021-35517[1]:
| When reading a specially crafted TAR archive, Compress can be made to
| allocate large amounts of memory that finally leads to an out of
| memory error even for very small inputs. This could be used to mount a
| denial of service attack against services that use Compress' tar
| package.

https://www.openwall.com/lists/oss-security/2021/07/13/3


CVE-2021-35516[2]:
| When reading a specially crafted 7Z archive, Compress can be made to
| allocate large amounts of memory that finally leads to an out of
| memory error even for very small inputs. This could be used to mount a
| denial of service attack against services that use Compress' sevenz
| package.

https://www.openwall.com/lists/oss-security/2021/07/13/2


CVE-2021-35515[3]:
| When reading a specially crafted 7Z archive, the construction of the
| list of codecs that decompress an entry can result in an infinite
| loop. This could be used to mount a denial of service attack against
| services that use Compress' sevenz package.

https://www.openwall.com/lists/oss-security/2021/07/13/1

	
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-36090
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36090
[1] https://security-tracker.debian.org/tracker/CVE-2021-35517
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35517
[2] https://security-tracker.debian.org/tracker/CVE-2021-35516
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35516
[3] https://security-tracker.debian.org/tracker/CVE-2021-35515
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35515

Please adjust the affected versions in the BTS as needed.