PT-2017-3769 · Libarchive+2 · Libarchive+2
Carnilo
·
Published
2017-09-16
·
Updated
2024-06-15
·
CVE-2017-14501
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
libarchive version 3.3.2
Description:
The issue is related to an out-of-bounds read flaw in the
archive read format iso9660 read header function in archive read support format iso9660.c of the libarchive library. This flaw can be exploited by a remote attacker using a specially crafted iso9660 file to gain unauthorized access to information. The vulnerability is also related to the parse file info function.Recommendations:
For libarchive version 3.3.2, consider updating to a newer version that contains a fix for this issue, as using a specially crafted iso9660 file can lead to exploitation. As a temporary workaround, consider restricting the use of the
archive read format iso9660 read header function and the parse file info function in archive read support format iso9660.c until a patch is available. Avoid using libarchive to extract specially crafted iso9660 files until the issue is resolved.Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Ubuntu
Libarchive