rpm package
suse/libarchive&distro=SUSE Linux Enterprise Software Development Kit 12 SP2
pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-8689 | Hig | 7.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Feb 15, 2017 | The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive. | |
| CVE-2016-8688 | Med | 5.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Feb 15, 2017 | The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchi | |
| CVE-2016-8687 | Hig | 7.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Feb 15, 2017 | Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename. | |
| CVE-2016-6250 | Hig | 8.6 | < 3.1.2-25.1 | 3.1.2-25.1 | Sep 21, 2016 | Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow. | |
| CVE-2016-5844 | Med | 6.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Sep 21, 2016 | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file. | |
| CVE-2016-5418 | Hig | 7.5 | < 3.1.2-25.1 | 3.1.2-25.1 | Sep 21, 2016 | The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file. | |
| CVE-2015-2304 | — | < 3.1.2-25.1 | 3.1.2-25.1 | Mar 15, 2015 | Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive. |
- affected < 3.1.2-25.1fixed 3.1.2-25.1
The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchi
- affected < 3.1.2-25.1fixed 3.1.2-25.1
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
- affected < 3.1.2-25.1fixed 3.1.2-25.1
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.
- CVE-2015-2304Mar 15, 2015affected < 3.1.2-25.1fixed 3.1.2-25.1
Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.