Published: 21/09/2016 Updated: 27/12/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Integer overflow in the ISO parser in libarchive prior to 3.2.1 allows remote malicious users to cause a denial of service (application crash) via a crafted ISO file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libarchive libarchive
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat enterprise linux desktop 6.0
redhat enterprise linux hpc node 6.0
redhat enterprise linux server eus 7.2
redhat enterprise linux workstation 7.0
redhat enterprise linux hpc node 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node eus 7.2
redhat enterprise linux server aus 7.2
redhat enterprise linux desktop 7.0
oracle linux 7
oracle linux 6
oracle solaris 11.3

libarchive could be made to crash or run programs if it opened a specially crafted file ...

A flaw was found in the way libarchive handled hardlink archive entries of non-zero size Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive (CVE-2016-5418) Multiple out-of-bounds write flaws were found in libarchive S ...

Undefined behavior (signed integer overflow) was discovered in libarchive, in the ISO parser A crafted file could potentially cause denial of service ...

CWE-190 https://blog.fuzzing-project.org/48-Out-of-bounds-read-and-signed-integer-overflow-in-libarchive.html http://rhn.redhat.com/errata/RHSA-2016-1850.html http://www.openwall.com/lists/oss-security/2016/06/23/6 http://rhn.redhat.com/errata/RHSA-2016-1844.html http://www.openwall.com/lists/oss-security/2016/06/24/4 http://www.securitytracker.com/id/1036173 https://bugzilla.redhat.com/show_bug.cgi?id=1350280 https://github.com/libarchive/libarchive/commit/3ad08e01b4d253c66ae56414886089684155af22 https://github.com/libarchive/libarchive/issues/717 http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html http://www.securityfocus.com/bid/91808 https://security.gentoo.org/glsa/201701-03 http://www.debian.org/security/2016/dsa-3657 https://usn.ubuntu.com/3033-1/https://nvd.nist.gov

CVE-2016-5844

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect