PT-2017-16606 · Libarchive+2 · Libarchive+2

Published 2017-01-27 · Updated 2024-06-15 · CVE-2017-5601

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive version 3.2.2

Description The issue is related to an error in the lha read file header 1() function, which can be exploited by remote attackers to trigger an out-of-bounds read memory access. This can be achieved by using a specially crafted archive, potentially leading to a crash.

Recommendations For libarchive version 3.2.2, consider applying a patch or fix that addresses the error in the lha read file header 1() function to prevent out-of-bounds read memory access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-5601

DLA-1600-1

DLA-810-1

MGASA-2017-0056

OPENSUSE-SU-2022:0944-1

OPENSUSE-SU-2022_0944-1

OPENSUSE-SU-2022_1930-1

OPENSUSE-SU-2024:13549-1

SUSE-SU-2022:0944-1

SUSE-SU-2022:0944-2

SUSE-SU-2022:1930-1

SUSE-SU-2022_0944-1

SUSE-SU-2022_0944-2

SUSE-SU-2022_1930-1

USN-3225-1

Affected Products

Suse

Ubuntu

Libarchive

References · 44

• https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9 · Patch
• https://advisories.mageia.org/MGASA-2017-0056.html · Security Note
• https://ubuntu.com/security/CVE-2017-5601 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5601 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5418 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0944-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5601 · Security Note
• https://osv.dev/vulnerability/DLA-1600-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7166 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0944-2 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5601 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0056 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8687 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0944-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-5601 · Vendor Advisory