PT-2017-16606 · Libarchive+2 · Libarchive+2

Publicado 2017-01-27 · Atualizado 2024-06-15 · CVE-2017-5601

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive version 3.2.2

Description The issue is related to an error in the lha read file header 1() function, which can be exploited by remote attackers to trigger an out-of-bounds read memory access. This can be achieved by using a specially crafted archive, potentially leading to a crash.

Recommendations For libarchive version 3.2.2, consider applying a patch or fix that addresses the error in the lha read file header 1() function to prevent out-of-bounds read memory access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2017-5601

DLA-1600-1

DLA-810-1

MGASA-2017-0056

OPENSUSE-SU-2022:0944-1

OPENSUSE-SU-2022_0944-1

OPENSUSE-SU-2022_1930-1

OPENSUSE-SU-2024:13549-1

SUSE-SU-2022:0944-1

SUSE-SU-2022:0944-2

SUSE-SU-2022:1930-1

SUSE-SU-2022_0944-1

SUSE-SU-2022_0944-2

SUSE-SU-2022_1930-1

USN-3225-1

Produtos afetados

Suse

Ubuntu

Libarchive

Referências · 44

• https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9 · Correção
• https://bugs.mageia.org/show_bug.cgi?id=20223 · Nota
• https://advisories.mageia.org/MGASA-2017-0056.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-5601 · Aviso do Fabricante
• https://bugzilla.suse.com/1188572 · Nota
• https://osv.dev/vulnerability/CVE-2017-5601 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-5418 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2022:0944-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2021-23177 · Nota
• https://suse.com/support/update/announcement/2022/suse-su-20220944-1 · Nota
• https://suse.com/support/update/announcement/2022/suse-su-20221930-1 · Nota
• https://cve.org/CVERecord?id=CVE-2017-5601 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-1600-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-7166 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2022:0944-2 · Aviso do Fabricante