PT-2017-9735 · Libarchive+3 · Libarchive+3

Doran Moppert · Published 2016-11-25 · Updated 2024-06-15 · CVE-2016-8687

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive version 3.2.1

Description The issue is related to a stack-based buffer overflow in the safe fprintf function, located in tar/util.c. This overflow can be triggered by remote attackers who send a crafted non-printable multibyte character in a filename, potentially causing a denial of service.

Recommendations For libarchive version 3.2.1, consider updating to a newer version that contains a fix for this issue, as using a crafted filename can cause a denial of service due to the buffer overflow in the safe fprintf function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-1245

CVE-2016-8687

DLA-1600-1

DLA-661-1

OPENSUSE-SU-2024:10127-1

SUSE-SU-2016:2911-1

USN-3225-1

Affected Products

Alt Linux

Suse

Ubuntu

Libarchive

References · 50

• https://github.com/libarchive/libarchive/commit/e37b620fe8f14535d737e89a4dcabaed4517bf1a · Patch
• https://ubuntu.com/security/CVE-2016-5418 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2911-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8687 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8687 · Security Note
• https://osv.dev/vulnerability/USN-3225-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8689 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8687 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10127-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1377926 · Patch
• https://ubuntu.com/security/CVE-2016-6250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7166 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8687 · Vendor Advisory