CVE-2018-12418

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/junrar/junrar/commit/ad8d0ba8e155630da8a1215cee3f253e0af45817Patch, Third Party Advisory
https://github.com/junrar/junrar/pull/8Third Party Advisory
https://github.com/junrar/junrar/commit/ad8d0ba8e155630da8a1215cee3f253e0af45817Patch, Third Party Advisory
https://github.com/junrar/junrar/pull/8Third Party Advisory

Timeline

Published: Jun 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-12426.5Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability CVE-2018-124207.5IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.CVE-2018-124219.8LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted CVE-2018-124229.8addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger CVE-2018-124237.5In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.CVE-2018-124269.8The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side va CVE-2018-124295.4JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administr CVE-2018-12437.5Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a wea CVE-2018-124314.8SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).CVE-2018-124326.1JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.CVE-2018-124334.9cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or CVE-2018-124344.7LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hi