PT-2016-4060 · Libarchive+2 · Libarchive+2

Hanno Böck + 1 · Publicado 2016-06-29 · Atualizado 2023-09-12 · CVE-2015-8918

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.2.0

Description The issue allows remote attackers to cause a denial of service (crash) via crafted cab files. This is related to "overlapping memcpy" in the archive string append function in archive string.c.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted cab files to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2016-1654

CVE-2015-8918

OPENSUSE-SU-2016_2036-1

SUSE-SU-2016:1909-1

SUSE-SU-2016:1939-1

SUSE-SU-2016_1909-1

Produtos afetados

Alt Linux

Suse

Libarchive

Referências · 130

• https://github.com/libarchive/libarchive/issues/746 · Nota
• https://github.com/libarchive/libarchive/issues/521 · Nota
• https://github.com/libarchive/libarchive/issues/503 · Nota
• https://github.com/libarchive/libarchive/issues/548 · Nota
• https://github.com/libarchive/libarchive/issues/547 · Nota
• https://github.com/libarchive/libarchive/issues/517 · Nota
• https://github.com/libarchive/libarchive/issues/516 · Nota
• https://github.com/libarchive/libarchive/issues/717 · Nota
• https://github.com/libarchive/libarchive/issues/539 · Nota
• https://github.com/libarchive/libarchive/issues/550 · Nota
• https://github.com/libarchive/libarchive/commit/3ad08e01b4d253c66ae56414886089684155af22 · Nota
• https://github.com/libarchive/libarchive/issues/523 · Nota
• https://github.com/libarchive/libarchive/issues/518 · Nota
• https://github.com/libarchive/libarchive/issues/506 · Correção
• https://bugzilla.suse.com/985700 · Nota