Medium severity6.5NVD Advisory· Published Sep 6, 2017· Updated May 13, 2026
CVE-2017-14166
CVE-2017-14166
Description
libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.
Affected products
5- cpe:2.3:a:libarchive:libarchive:3.3.2:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 1 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- blogs.gentoo.org/ago/2017/09/06/libarchive-heap-based-buffer-overflow-in-xml_data-archive_read_support_format_xar-c/nvdPatchThird Party Advisory
- github.com/libarchive/libarchive/commit/fa7438a0ff4033e4741c807394a9af6207940d71nvdPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2018/11/msg00037.htmlnvdMailing ListThird Party Advisory
- usn.ubuntu.com/3736-1/nvdThird Party Advisory
- www.debian.org/security/2018/dsa-4360nvdThird Party Advisory
- security.gentoo.org/glsa/201908-11nvd
News mentions
0No linked articles in our index yet.