Published: 15/02/2017 Updated: 30/11/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote malicious users to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libarchive libarchive 3.2.1
opensuse leap 42.2

libarchive could be made to crash, overwrite files, or run programs as your login if it opened a specially crafted file ...

Debian Bug report logs - #840934 libarchive: CVE-2016-8689: heap-based buffer overflow in read_Header Package: src:libarchive; Maintainer for src:libarchive is Peter Pentchev <roam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 16 Oct 2016 09:42:02 UTC Severity: grave Tags: patch, secur ...

Debian Bug report logs - #840936 libarchive: CVE-2016-8687: bsdtar: stack-based buffer overflow in bsdtar_expand_char Package: src:libarchive; Maintainer for src:libarchive is Peter Pentchev <roam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 16 Oct 2016 09:51:04 UTC Severity: grave Ta ...

Debian Bug report logs - #840935 libarchive: CVE-2016-8688: Out of bounds read in mtree parser Package: src:libarchive; Maintainer for src:libarchive is Peter Pentchev <roam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 16 Oct 2016 09:51:01 UTC Severity: grave Tags: fixed-upstream, pat ...

The read_Header function in archive_read_support_format_7zipc in libarchive 321 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive ...

CWE-125 https://security.gentoo.org/glsa/201701-03 https://github.com/libarchive/libarchive/commit/7f17c791dcfd8c0416e2cd2485b19410e47ef126 https://bugzilla.redhat.com/show_bug.cgi?id=1377925 https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-heap-based-buffer-overflow-in-read_header-archive_read_support_format_7zip-c/http://www.securityfocus.com/bid/93781 http://www.openwall.com/lists/oss-security/2016/10/16/11 http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.html https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html https://usn.ubuntu.com/3225-1/https://nvd.nist.gov

CVE-2016-8689

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect