Published: 21/09/2016 Updated: 27/12/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 8.6 | Impact Score: 4.7 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Integer overflow in the ISO9660 writer in libarchive prior to 3.2.1 allows remote malicious users to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle linux 7
libarchive libarchive

Debian Bug report logs - #837714 libarchive: CVE-2016-5418: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite Package: src:libarchive; Maintainer for src:libarchive is Peter Pentchev <roam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 13 Sep 2016 19:45:02 ...

libarchive could be made to crash, overwrite files, or run programs as your login if it opened a specially crafted file ...

Several vulnerabilities were discovered in libarchive, a multi-format archive and compression library, which may lead to denial of service (memory consumption and application crash), bypass of sandboxing restrictions and overwrite arbitrary files with arbitrary data from an archive, or the execution of arbitrary code For the stable distribution (j ...

A flaw was found in the way libarchive handled hardlink archive entries of non-zero size Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive (CVE-2016-5418) Multiple out-of-bounds write flaws were found in libarchive S ...

A vulnerability was found in libarchive An attempt to create an ISO9660 volume with 2GB or 4GB filenames could cause the application to crash ...

CWE-190 https://github.com/libarchive/libarchive/files/295073/libarchiveOverflow.txt https://github.com/libarchive/libarchive/issues/711 https://bugzilla.redhat.com/show_bug.cgi?id=1347085 http://www.openwall.com/lists/oss-security/2016/07/20/1 http://www.openwall.com/lists/oss-security/2016/07/21/3 http://www.securitytracker.com/id/1036431 https://github.com/libarchive/libarchive/commit/3014e198 http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html http://www.securityfocus.com/bid/92036 https://security.gentoo.org/glsa/201701-03 http://rhn.redhat.com/errata/RHSA-2016-1844.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837714 https://usn.ubuntu.com/3225-1/https://nvd.nist.gov

CVE-2016-6250

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect