PT-2016-4061 · Libarchive+1 · Libarchive+1

Hanno Böck · Published 2016-06-29 · Updated 2017-07-01 · CVE-2015-8927

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.2.0

Description The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds heap read and crash, by providing a crafted zip file. This is related to the reading of the password in the trad enc decrypt update function.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the trad enc decrypt update function when handling zip files from untrusted sources. Restrict access to zip files to minimize the risk of exploitation.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2016-1654

CVE-2015-8927

Affected Products

Alt Linux

Libarchive

References · 65

• 🔥 https://github.com/libarchive/libarchive/issues/523 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8934 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-8927 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8923 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5418 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4302 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-8927 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8930 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8927 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8924 · Security Note
• https://bdu.fstec.ru/vul/2016-01145 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6250 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1654 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8929 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4301 · Security Note