rpm package
suse/libarchive&distro=SUSE Linux Enterprise Software Development Kit 12 SP1
pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1
Vulnerabilities (28)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-8689 | Hig | 7.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Feb 15, 2017 | The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive. | |
| CVE-2016-8688 | Med | 5.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Feb 15, 2017 | The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchi | |
| CVE-2016-8687 | Hig | 7.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Feb 15, 2017 | Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename. | |
| CVE-2016-6250 | Hig | 8.6 | < 3.1.2-25.1 | 3.1.2-25.1 | Sep 21, 2016 | Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow. | |
| CVE-2016-5844 | Med | 6.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Sep 21, 2016 | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file. | |
| CVE-2016-5418 | Hig | 7.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Sep 21, 2016 | The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file. | |
| CVE-2016-4809 | Hig | 7.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 21, 2016 | The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink. | |
| CVE-2016-4302 | Hig | 7.8 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 21, 2016 | Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary. | |
| CVE-2016-4301 | Hig | 7.8 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 21, 2016 | Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file. | |
| CVE-2016-4300 | Hig | 7.8 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 21, 2016 | Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow. | |
| CVE-2015-8934 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file. | |
| CVE-2015-8933 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file. | |
| CVE-2015-8932 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift. | |
| CVE-2015-8931 | Hig | 7.8 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior. | |
| CVE-2015-8930 | Hig | 7.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself. | |
| CVE-2015-8929 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file. | |
| CVE-2015-8928 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file. | |
| CVE-2015-8926 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive. | |
| CVE-2015-8925 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing. | |
| CVE-2015-8924 | Med | 5.5 | < 3.1.2-22.1 | 3.1.2-22.1 | Sep 20, 2016 | The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file. |
- affected < 3.1.2-25.1fixed 3.1.2-25.1
The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchi
- affected < 3.1.2-25.1fixed 3.1.2-25.1
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.
- affected < 3.1.2-22.1fixed 3.1.2-22.1
The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.
Page 1 of 2