Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.
{"osv": [{"lastseen": "2022-08-10T07:08:29", "description": "\nRock Stevens, Andrew Ruef and Marcin Icewall Noga discovered a\nheap-based buffer overflow vulnerability in the zip\\_read\\_mac\\_metadata\nfunction in libarchive, a multi-format archive and compression library,\nwhich may lead to the execution of arbitrary code if a user or automated\nsystem is tricked into processing a specially crafted ZIP file.\n\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 3.1.2-11+deb8u1.\n\n\nWe recommend that you upgrade your libarchive packages.\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-05-10T00:00:00", "type": "osv", "title": "libarchive - security update", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2022-08-10T07:08:28", "id": "OSV:DSA-3574-1", "href": "https://osv.dev/vulnerability/DSA-3574-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-06-27T02:10:50", "description": "Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.", "cvss3": {}, "published": "2016-05-07T10:59:00", "type": "osv", "title": "CVE-2016-1541", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2023-06-27T02:10:48", "id": "OSV:CVE-2016-1541", "href": "https://osv.dev/vulnerability/CVE-2016-1541", "cvss": {"score": 0.0, "vector": "NONE"}}], "fedora": [{"lastseen": "2020-12-21T08:17:53", "description": "Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-05-14T23:33:59", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: libarchive-3.1.2-17.fc24", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-14T23:33:59", "id": "FEDORA:E6ADF60A616F", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JMDYR6YFZCC4STQYJC4KU45QRMQLNAQK/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:53", "description": "Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-05-16T22:29:12", "type": "fedora", "title": "[SECURITY] Fedora 23 Update: libarchive-3.1.2-15.fc23", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-16T22:29:12", "id": "FEDORA:EF72360D32A6", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/R7ELLVKOAE72HDPYL3HNS5LXWC5KH73O/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:53", "description": "Libarchive is a programming library that can create and read several differ ent streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-05-31T09:24:54", "type": "fedora", "title": "[SECURITY] Fedora 22 Update: libarchive-3.1.2-14.fc22", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-31T09:24:54", "id": "FEDORA:E3B9860BC98F", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AYD77HGGQSR4ORYEDMACOVKYHKWPYUR4/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "mageia": [{"lastseen": "2023-12-02T20:47:30", "description": "Updated libarchive packages fix security vulnerability: Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive (CVE-2016-1541). The libarchive package has been updated to version 3.2.0, fixing this issue and other bugs. \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-18T23:14:22", "type": "mageia", "title": "Updated libarchive packages fix CVE-2016-1541\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-18T23:14:21", "id": "MGASA-2016-0179", "href": "https://advisories.mageia.org/MGASA-2016-0179.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2017-07-24T12:54:29", "description": "Rock Stevens, Andrew Ruef and Marcin\nIcewall Noga discovered a heap-based buffer overflow vulnerability in the\nzip_read_mac_metadata function in libarchive, a multi-format archive and compression\nlibrary, which may lead to the execution of arbitrary code if a user or automated\nsystem is tricked into processing a specially crafted ZIP file.", "cvss3": {}, "published": "2016-05-10T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3574-1 (libarchive - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:703574", "href": "http://plugins.openvas.org/nasl.php?oid=703574", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3574.nasl 6608 2017-07-07 12:05:05Z cfischer $\n# Auto-generated from advisory DSA 3574-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703574);\n script_version(\"$Revision: 6608 $\");\n script_cve_id(\"CVE-2016-1541\");\n script_name(\"Debian Security Advisory DSA 3574-1 (libarchive - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:05 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2016-05-10 00:00:00 +0200 (Tue, 10 May 2016)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2016/dsa-3574.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"libarchive on Debian Linux\");\n script_tag(name: \"insight\", value: \"The libarchive library provides a\nflexible interface for reading and writing streaming archive files such as\ntar and cpio.\");\n script_tag(name: \"solution\", value: \"For the stable distribution (jessie),\nthis problem has been fixed in version 3.1.2-11+deb8u1.\n\nWe recommend that you upgrade your libarchive packages.\");\n script_tag(name: \"summary\", value: \"Rock Stevens, Andrew Ruef and Marcin\nIcewall Noga discovered a heap-based buffer overflow vulnerability in the\nzip_read_mac_metadata function in libarchive, a multi-format archive and compression\nlibrary, which may lead to the execution of arbitrary code if a user or automated\nsystem is tricked into processing a specially crafted ZIP file.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"bsdcpio\", ver:\"3.1.2-11+deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"bsdtar\", ver:\"3.1.2-11+deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libarchive-dev:amd64\", ver:\"3.1.2-11+deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libarchive-dev:i386\", ver:\"3.1.2-11+deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif ((res = isdpkgvuln(pkg:\"libarchive13:amd64\", ver:\"3.1.2-11+deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libarchive13:i386\", ver:\"3.1.2-11+deb8u1\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:35:04", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2016-06-08T00:00:00", "type": "openvas", "title": "Fedora Update for libarchive FEDORA-2016-760bd8b6a5", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310808393", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310808393", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libarchive FEDORA-2016-760bd8b6a5\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.808393\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-06-08 15:54:42 +0200 (Wed, 08 Jun 2016)\");\n script_cve_id(\"CVE-2016-1541\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libarchive FEDORA-2016-760bd8b6a5\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libarchive'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"libarchive on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-760bd8b6a5\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMDYR6YFZCC4STQYJC4KU45QRMQLNAQK\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"libarchive\", rpm:\"libarchive~3.1.2~17.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:44", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2016-06-08T00:00:00", "type": "openvas", "title": "Fedora Update for libarchive FEDORA-2016-19c34099d3", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310808301", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310808301", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libarchive FEDORA-2016-19c34099d3\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.808301\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-06-08 15:37:45 +0200 (Wed, 08 Jun 2016)\");\n script_cve_id(\"CVE-2016-1541\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libarchive FEDORA-2016-19c34099d3\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libarchive'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"libarchive on Fedora 22\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-19c34099d3\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYD77HGGQSR4ORYEDMACOVKYHKWPYUR4\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC22\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC22\")\n{\n\n if ((res = isrpmvuln(pkg:\"libarchive\", rpm:\"libarchive~3.1.2~14.fc22\", rls:\"FC22\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:32", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2016-06-08T00:00:00", "type": "openvas", "title": "Fedora Update for libarchive FEDORA-2016-8491ec1ebd", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310808354", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310808354", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for libarchive FEDORA-2016-8491ec1ebd\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.808354\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-06-08 15:36:34 +0200 (Wed, 08 Jun 2016)\");\n script_cve_id(\"CVE-2016-1541\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libarchive FEDORA-2016-8491ec1ebd\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libarchive'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"libarchive on Fedora 23\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2016-8491ec1ebd\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7ELLVKOAE72HDPYL3HNS5LXWC5KH73O\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC23\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC23\")\n{\n\n if ((res = isrpmvuln(pkg:\"libarchive\", rpm:\"libarchive~3.1.2~15.fc23\", rls:\"FC23\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:50", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2016-05-18T00:00:00", "type": "openvas", "title": "Ubuntu Update for libarchive USN-2981-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2019-03-13T00:00:00", "id": "OPENVAS:1361412562310842765", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842765", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for libarchive USN-2981-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842765\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-05-18 05:19:39 +0200 (Wed, 18 May 2016)\");\n script_cve_id(\"CVE-2016-1541\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for libarchive USN-2981-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libarchive'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"It was discovered that libarchive incorrectly\n handled certain entry-size values in ZIP archives. A remote attacker could use this\n issue to cause libarchive to crash, resulting in a denial of service, or possibly\n execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10\n and Ubuntu 16.04 LTS. (CVE-2016-1541)\n\n It was discovered that libarchive incorrectly handled memory when\n processing certain tar files. A remote attacker could use this issue to\n cause libarchive to crash, resulting in a denial of service. (CVE number\n pending)\");\n script_tag(name:\"affected\", value:\"libarchive on Ubuntu 16.04 LTS,\n Ubuntu 15.10,\n Ubuntu 14.04 LTS,\n Ubuntu 12.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"2981-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2981-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|12\\.04 LTS|16\\.04 LTS|15\\.10)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libarchive13:i386\", ver:\"3.1.2-7ubuntu2.2\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libarchive13:amd64\", ver:\"3.1.2-7ubuntu2.2\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU12.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libarchive12:i386\", ver:\"3.0.3-6ubuntu1.2\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libarchive12:amd64\", ver:\"3.0.3-6ubuntu1.2\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU16.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libarchive13:i386\", ver:\"3.1.2-11ubuntu0.16.04.1\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libarchive13:amd64\", ver:\"3.1.2-11ubuntu0.16.04.1\", rls:\"UBUNTU16.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU15.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libarchive13:i386\", ver:\"3.1.2-11ubuntu0.15.10.1\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"libarchive13:amd64\", ver:\"3.1.2-11ubuntu0.15.10.1\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:41", "description": "Rock Stevens, Andrew Ruef and Marcin\nIcewall Noga discovered a heap-based buffer overflow vulnerability in the\nzip_read_mac_metadata function in libarchive, a multi-format archive and compression\nlibrary, which may lead to the execution of arbitrary code if a user or automated\nsystem is tricked into processing a specially crafted ZIP file.", "cvss3": {}, "published": "2016-05-10T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3574-1 (libarchive - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310703574", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703574", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3574.nasl 14279 2019-03-18 14:48:34Z cfischer $\n# Auto-generated from advisory DSA 3574-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703574\");\n script_version(\"$Revision: 14279 $\");\n script_cve_id(\"CVE-2016-1541\");\n script_name(\"Debian Security Advisory DSA 3574-1 (libarchive - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:48:34 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-05-10 00:00:00 +0200 (Tue, 10 May 2016)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2016/dsa-3574.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2016 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n script_tag(name:\"affected\", value:\"libarchive on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (jessie),\nthis problem has been fixed in version 3.1.2-11+deb8u1.\n\nWe recommend that you upgrade your libarchive packages.\");\n script_tag(name:\"summary\", value:\"Rock Stevens, Andrew Ruef and Marcin\nIcewall Noga discovered a heap-based buffer overflow vulnerability in the\nzip_read_mac_metadata function in libarchive, a multi-format archive and compression\nlibrary, which may lead to the execution of arbitrary code if a user or automated\nsystem is tricked into processing a specially crafted ZIP file.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software\nversion using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"bsdcpio\", ver:\"3.1.2-11+deb8u1\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"bsdtar\", ver:\"3.1.2-11+deb8u1\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libarchive-dev:amd64\", ver:\"3.1.2-11+deb8u1\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libarchive-dev:i386\", ver:\"3.1.2-11+deb8u1\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif((res = isdpkgvuln(pkg:\"libarchive13:amd64\", ver:\"3.1.2-11+deb8u1\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libarchive13:i386\", ver:\"3.1.2-11+deb8u1\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:00", "description": "Splunk Enterprise is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2016-09-19T00:00:00", "type": "openvas", "title": "Splunk Enterprise Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-4858", "CVE-2015-2304", "CVE-2013-0211", "CVE-2016-1541"], "modified": "2018-11-12T00:00:00", "id": "OPENVAS:1361412562310106263", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310106263", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_splunk_enterprise_mult_vuln.nasl 12313 2018-11-12 08:53:51Z asteins $\n#\n# Splunk Enterprise Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = 'cpe:/a:splunk:splunk';\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.106263\");\n script_version(\"$Revision: 12313 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-12 09:53:51 +0100 (Mon, 12 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-09-19 11:58:34 +0700 (Mon, 19 Sep 2016)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n\n script_cve_id(\"CVE-2016-1541\", \"CVE-2015-2304\", \"CVE-2013-0211\", \"CVE-2016-4858\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"Splunk Enterprise Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_splunk_detect.nasl\");\n script_mandatory_keys(\"Splunk/installed\");\n\n script_tag(name:\"summary\", value:\"Splunk Enterprise is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Splunk Enterprise is affected by multiple vulnerabilities:\n\nSplunk Enterprise is affected by multiple vulnerabilities in libarchive (CVE-2016-1541, CVE-2015-2304,\nCVE-2013-0211).\n\nSplunk Enterprise contains a cross-site scripting vulnerability\");\n\n script_tag(name:\"affected\", value:\"Splunk Enterprise 6.4.x, 6.3.x, 6.2.x, 6.1.x, 6.0.x and 5.0.x\");\n\n script_tag(name:\"solution\", value:\"Update to version 6.4.2, 6.3.6, 6.2.10, 6.1.11, 6.0.12, 5.0.16 or later.\");\n\n script_xref(name:\"URL\", value:\"https://www.splunk.com/view/SP-CAAAPQM\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!version = get_app_version(cpe: CPE, port: port))\n exit(0);\n\nif (version =~ \"^6\\.4\") {\n if (version_is_less(version: version, test_version: \"6.4.2\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"6.4.2\");\n security_message(port: port, data: report);\n exit(0);\n }\n}\n\nif (version =~ \"^6\\.3\") {\n if (version_is_less(version: version, test_version: \"6.3.6\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"6.3.6\");\n security_message(port: port, data: report);\n exit(0);\n }\n}\n\n\nif (version =~ \"^6\\.2\") {\n if (version_is_less(version: version, test_version: \"6.2.10\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"6.2.10\");\n security_message(port: port, data: report);\n exit(0);\n }\n}\n\nif (version =~ \"^6\\.1\") {\n if (version_is_less(version: version, test_version: \"6.1.11\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"6.1.11\");\n security_message(port: port, data: report);\n exit(0);\n }\n}\n\nif (version =~ \"^6\\.0\") {\n if (version_is_less(version: version, test_version: \"6.0.12\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"6.0.12\");\n security_message(port: port, data: report);\n exit(0);\n }\n}\n\nif (version_is_less(version: version, test_version: \"5.0.16\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"5.0.16\");\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:36", "description": "Splunk Light is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2016-09-19T00:00:00", "type": "openvas", "title": "Splunk Light Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-4857", "CVE-2016-2108", "CVE-2016-4858", "CVE-2016-2105", "CVE-2016-2107", "CVE-2016-2109", "CVE-2016-2176", "CVE-2015-2304", "CVE-2013-0211", "CVE-2016-1541", "CVE-2016-2106"], "modified": "2018-10-25T00:00:00", "id": "OPENVAS:1361412562310106267", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310106267", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_splunk_light_mult_vuln.nasl 12096 2018-10-25 12:26:02Z asteins $\n#\n# Splunk Light Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2016 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = 'cpe:/a:splunk:light';\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.106267\");\n script_version(\"$Revision: 12096 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-25 14:26:02 +0200 (Thu, 25 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-09-19 11:58:34 +0700 (Mon, 19 Sep 2016)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_cve_id(\"CVE-2016-2105\", \"CVE-2016-2106\", \"CVE-2016-2107\", \"CVE-2016-2108\", \"CVE-2016-2109\",\n\"CVE-2016-2176\", \"CVE-2016-1541\", \"CVE-2015-2304\", \"CVE-2013-0211\", \"CVE-2016-4858\", \"CVE-2016-4857\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"Splunk Light Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_splunk_light_detect.nasl\");\n script_mandatory_keys(\"SplunkLight/installed\");\n\n script_tag(name:\"summary\", value:\"Splunk Light is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Splunk Light is affected by multiple vulnerabilities:\n\nMultiple OpenSSL vulnerabilities (CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2108, CVE-2016-2109,\nCVE-2016-2176).\n\nMultiple vulnerabilities in libarchive (CVE-2016-1541, CVE-2015-2304, CVE-2013-0211).\n\nOpen redirect vulnerability (CVE-2016-4857).\n\nCross-site scripting vulnerability (CVE-2016-4858).\");\n\n script_tag(name:\"affected\", value:\"Splunk Light before 6.4.2\");\n\n script_tag(name:\"solution\", value:\"Update to version 6.4.2 or later.\");\n\n script_xref(name:\"URL\", value:\"https://www.splunk.com/view/SP-CAAAPQM\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!version = get_app_version(cpe: CPE, port: port))\n exit(0);\n\nif (version_is_less(version: version, test_version: \"6.4.2\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"6.4.2\");\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:35:22", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2016-09-13T00:00:00", "type": "openvas", "title": "RedHat Update for libarchive RHSA-2016:1844-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6250", "CVE-2015-8923", "CVE-2016-7166", "CVE-2015-8917", "CVE-2015-8921", "CVE-2015-8926", "CVE-2015-8919", "CVE-2015-8934", "CVE-2016-5418", "CVE-2016-5844", "CVE-2015-8930", "CVE-2015-8920", "CVE-2015-8924", "CVE-2015-8932", "CVE-2016-4809", "CVE-2015-8928", "CVE-2015-8916", "CVE-2016-4302", "CVE-2015-8925", "CVE-2016-1541", "CVE-2016-4300", "CVE-2015-8922", "CVE-2015-8931"], "modified": "2018-11-23T00:00:00", "id": "OPENVAS:1361412562310871659", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871659", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# RedHat Update for libarchive RHSA-2016:1844-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871659\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2016-09-13 05:45:09 +0200 (Tue, 13 Sep 2016)\");\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\",\n\t\t\"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\",\n\t\t\"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\",\n\t\t\"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\",\n\t\t\"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\",\n\t\t\"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"RedHat Update for libarchive RHSA-2016:1844-01\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libarchive'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The libarchive programming library can create\n and read several different streaming archive formats, including GNU tar, cpio, and\n ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting\n language bindings such as python-libarchive, and several popular desktop\n file managers.\n\nSecurity Fix(es):\n\n * A flaw was found in the way libarchive handled hardlink archive entries\nof non-zero size. Combined with flaws in libarchive's file system\nsandboxing, this issue could cause an application using libarchive to\noverwrite arbitrary files with arbitrary data from the archive.\n(CVE-2016-5418)\n\n * Multiple out-of-bounds write flaws were found in libarchive. Specially\ncrafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially\nallowing code execution in the context of the application using libarchive.\n(CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n * Multiple out-of-bounds read flaws were found in libarchive. Specially\ncrafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the\napplication to read data out of bounds, potentially disclosing a small\namount of application memory, or causing an application crash.\n(CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924,\nCVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n * Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application using\nlibarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n * Multiple infinite loop / resource exhaustion flaws were found in\nlibarchive. Specially crafted GZIP or ISO files could cause the application\nto consume an excessive amount of resources, eventually leading to a crash\non memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n * A denial of service vulnerability was found in libarchive. A specially\ncrafted CPIO archive containing a symbolic link to a large target path\ncould cause memory allocation to fail, causing an application using\nlibarchive that attempted to view or extract such archive to crash.\n(CVE-2016-4809)\n\n * An integer overflow flaw, leading to a buffer overflow, was found in\nlibarchive's construction of ISO9660 volumes. Attempting to create an\nISO9660 volume with 2 GB or 4 GB file names could cause the application to\nattempt to allocate 20 GB of memory. If this were to succeed, it could lead\nto an out of bounds write on the heap and potential code execution.\n(CVE-2016-6250)\n\n * Multiple instances of undefined behavior due to arithmetic overflow were\nfound in libarchive. Specially crafted MTREE archives, Compress streams, or\nISO9660 vol ...\n\n Description truncated, please see the referenced URL(s) for more information.\");\n script_tag(name:\"affected\", value:\"libarchive on Red Hat Enterprise Linux Server (v. 7)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"RHSA\", value:\"2016:1844-01\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2016-September/msg00014.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_7\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_7\")\n{\n\n if ((res = isrpmvuln(pkg:\"libarchive\", rpm:\"libarchive~3.1.2~10.el7_2\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libarchive-debuginfo\", rpm:\"libarchive-debuginfo~3.1.2~10.el7_2\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-03-17T22:55:16", "description": "The remote host is missing an update announced via the referenced Security Advisory.", "cvss3": {}, "published": "2016-10-26T00:00:00", "type": "openvas", "title": "Amazon Linux: Security Advisory (ALAS-2016-743)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6250", "CVE-2015-8923", "CVE-2016-7166", "CVE-2015-8917", "CVE-2015-8921", "CVE-2015-8926", "CVE-2015-8919", "CVE-2015-8934", "CVE-2016-5418", "CVE-2016-5844", "CVE-2015-8930", "CVE-2015-8920", "CVE-2015-8924", "CVE-2015-8932", "CVE-2016-4809", "CVE-2015-8928", "CVE-2015-8916", "CVE-2016-4302", "CVE-2015-8925", "CVE-2016-1541", "CVE-2016-4300", "CVE-2015-8922", "CVE-2015-8931"], "modified": "2020-03-13T00:00:00", "id": "OPENVAS:1361412562310120732", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120732", "sourceData": "# Copyright (C) 2016 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.120732\");\n script_version(\"2020-03-13T13:19:50+0000\");\n script_tag(name:\"creation_date\", value:\"2016-10-26 15:38:23 +0300 (Wed, 26 Oct 2016)\");\n script_tag(name:\"last_modification\", value:\"2020-03-13 13:19:50 +0000 (Fri, 13 Mar 2020)\");\n script_name(\"Amazon Linux: Security Advisory (ALAS-2016-743)\");\n script_tag(name:\"insight\", value:\"Multiple flaws were found in libarchive. Please see the references for more information.\");\n script_tag(name:\"solution\", value:\"Run yum update libarchive to update your system.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://alas.aws.amazon.com/ALAS-2016-743.html\");\n script_cve_id(\"CVE-2015-8928\", \"CVE-2015-8934\", \"CVE-2016-4302\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8932\", \"CVE-2015-8919\", \"CVE-2016-1541\", \"CVE-2015-8917\", \"CVE-2015-8916\", \"CVE-2016-4300\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-6250\", \"CVE-2016-5844\", \"CVE-2016-7166\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/amazon_linux\", \"ssh/login/release\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"The remote host is missing an update announced via the referenced Security Advisory.\");\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Amazon Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"AMAZON\") {\n if(!isnull(res = isrpmvuln(pkg:\"libarchive-devel\", rpm:\"libarchive-devel~3.1.2~10.11.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"bsdtar\", rpm:\"bsdtar~3.1.2~10.11.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libarchive\", rpm:\"libarchive~3.1.2~10.11.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"bsdcpio\", rpm:\"bsdcpio~3.1.2~10.11.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libarchive-debuginfo\", rpm:\"libarchive-debuginfo~3.1.2~10.11.amzn1\", rls:\"AMAZON\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-27T18:36:08", "description": "The remote host is missing an update for the Huawei EulerOS\n ", "cvss3": {}, "published": "2020-01-23T00:00:00", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2016-1045)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6250", "CVE-2015-8923", "CVE-2016-7166", "CVE-2015-8917", "CVE-2015-8921", "CVE-2015-8926", "CVE-2015-8919", "CVE-2015-8934", "CVE-2016-5418", "CVE-2016-5844", "CVE-2015-8930", "CVE-2015-8920", "CVE-2015-8924", "CVE-2015-8932", "CVE-2016-4809", "CVE-2015-8928", "CVE-2015-8916", "CVE-2016-4302", "CVE-2015-8925", "CVE-2016-1541", "CVE-2016-4300", "CVE-2015-8922", "CVE-2015-8931"], "modified": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220161045", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220161045", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2016.1045\");\n script_version(\"2020-01-23T10:40:13+0000\");\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 10:40:13 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 10:40:13 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2016-1045)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP1\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2016-1045\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2016-1045\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libarchive' package(s) announced via the EulerOS-SA-2016-1045 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\nMultiple out-of-bounds write flaws were found in libarchive.\nSpecially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\nMultiple out-of-bounds read flaws were found in libarchive.\nSpecially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\nMultiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\nMultiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\nA denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\nAn integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\nMultiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\");\n\n script_tag(name:\"affected\", value:\"'libarchive' package(s) on Huawei EulerOS V2.0SP1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libarchive\", rpm:\"libarchive~3.1.2~10\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:30", "description": "Check the version of bsdcpio", "cvss3": {}, "published": "2016-09-16T00:00:00", "type": "openvas", "title": "CentOS Update for bsdcpio CESA-2016:1844 centos7", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6250", "CVE-2015-8923", "CVE-2016-7166", "CVE-2015-8917", "CVE-2015-8921", "CVE-2015-8926", "CVE-2015-8919", "CVE-2015-8934", "CVE-2016-5418", "CVE-2016-5844", "CVE-2015-8930", "CVE-2015-8920", "CVE-2015-8924", "CVE-2015-8932", "CVE-2016-4809", "CVE-2015-8928", "CVE-2015-8916", "CVE-2016-4302", "CVE-2015-8925", "CVE-2016-1541", "CVE-2016-4300", "CVE-2015-8922", "CVE-2015-8931"], "modified": "2019-03-08T00:00:00", "id": "OPENVAS:1361412562310882556", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882556", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for bsdcpio CESA-2016:1844 centos7\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.882556\");\n script_version(\"$Revision: 14058 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-08 14:25:52 +0100 (Fri, 08 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-09-16 05:41:37 +0200 (Fri, 16 Sep 2016)\");\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\",\n \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\",\n \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\",\n \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\",\n \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\",\n \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"CentOS Update for bsdcpio CESA-2016:1844 centos7\");\n script_tag(name:\"summary\", value:\"Check the version of bsdcpio\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The libarchive programming library can\ncreate and read several different streaming archive formats, including GNU tar,\ncpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar\nutility, scripting language bindings such as python-libarchive, and several\npopular desktop file managers.\n\nSecurity Fix(es):\n\n * A flaw was found in the way libarchive handled hardlink archive entries\nof non-zero size. Combined with flaws in libarchive's file system\nsandboxing, this issue could cause an application using libarchive to\noverwrite arbitrary files with arbitrary data from the archive.\n(CVE-2016-5418)\n\n * Multiple out-of-bounds write flaws were found in libarchive. Specially\ncrafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially\nallowing code execution in the context of the application using libarchive.\n(CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n * Multiple out-of-bounds read flaws were found in libarchive. Specially\ncrafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the\napplication to read data out of bounds, potentially disclosing a small\namount of application memory, or causing an application crash.\n(CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924,\nCVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n * Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application using\nlibarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n * Multiple infinite loop / resource exhaustion flaws were found in\nlibarchive. Specially crafted GZIP or ISO files could cause the application\nto consume an excessive amount of resources, eventually leading to a crash\non memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n * A denial of service vulnerability was found in libarchive. A specially\ncrafted CPIO archive containing a symbolic link to a large target path\ncould cause memory allocation to fail, causing an application using\nlibarchive that attempted to view or extract such archive to crash.\n(CVE-2016-4809)\n\n * An integer overflow flaw, leading to a buffer overflow, was found in\nlibarchive's construction of ISO9660 volumes. Attempting to create an\nISO9660 volume with 2 GB or 4 GB file names could cause the application to\nattempt to allocate 20 GB of memory. If this were to succeed, it could lead\nto an out of bounds write on the heap and potential code execution.\n(CVE-2016-6250)\n\n * Multiple instances of undefined behavior due to arithmetic overflow were\nfound in libarchive. Specially crafted MTREE archives, Compress streams, or\nISO9660 volumes could potentially cause the application to fail to read the\narchive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting CVE-2016-5418.\");\n script_tag(name:\"affected\", value:\"bsdcpio on CentOS 7\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"CESA\", value:\"2016:1844\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2016-September/022073.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS7\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS7\")\n{\n\n if ((res = isrpmvuln(pkg:\"bsdcpio\", rpm:\"bsdcpio~3.1.2~10.el7_2\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"bsdtar\", rpm:\"bsdtar~3.1.2~10.el7_2\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libarchive\", rpm:\"libarchive~3.1.2~10.el7_2\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libarchive-devel\", rpm:\"libarchive-devel~3.1.2~10.el7_2\", rls:\"CentOS7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-27T18:39:36", "description": "The remote host is missing an update for the Huawei EulerOS\n ", "cvss3": {}, "published": "2020-01-23T00:00:00", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2019-1470)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-6250", "CVE-2015-8923", "CVE-2016-7166", "CVE-2015-8917", "CVE-2015-8921", "CVE-2015-8926", "CVE-2015-8919", "CVE-2015-8934", "CVE-2016-5418", "CVE-2016-5844", "CVE-2015-8930", "CVE-2015-8920", "CVE-2015-8924", "CVE-2015-8932", "CVE-2016-4809", "CVE-2015-8928", "CVE-2015-8916", "CVE-2016-4302", "CVE-2015-8925", "CVE-2013-0211", "CVE-2016-1541", "CVE-2016-4300", "CVE-2015-8922", "CVE-2015-8931"], "modified": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191470", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191470", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1470\");\n script_version(\"2020-01-23T11:48:26+0000\");\n script_cve_id(\"CVE-2013-0211\", \"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:48:26 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:48:26 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2019-1470)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-3\\.0\\.1\\.0\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1470\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1470\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libarchive' package(s) announced via the EulerOS-SA-2019-1470 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A vulnerability was found in libarchive. A specially crafted MTREE file could cause a small out-of-bounds read, potentially disclosing a small amount of application memory.(CVE-2015-8925)\n\nA vulnerability was found in libarchive. An attempt to create an ISO9660 volume with 2GB or 4GB filenames could cause the application to crash.(CVE-2016-6250)\n\nA vulnerability was found in libarchive. A specially crafted RAR file could cause the application to read memory beyond the end of the decompression buffer.(CVE-2015-8934)\n\nA vulnerability was found in libarchive's handling of 7zip data. A specially crafted 7zip file can cause a integer overflow resulting in memory corruption that can lead to code execution.(CVE-2016-4300)\n\nA vulnerability was found in libarchive. A specially crafted 7Z file could trigger a NULL pointer dereference, causing the application to crash.(CVE-2015-8922)\n\nUndefined behavior (signed integer overflow) was discovered in libarchive, in the ISO parser. A crafted file could potentially cause denial of service.(CVE-2016-5844)\n\nA vulnerability was found in libarchive. A specially crafted AR archive could cause the application to read a single byte of application memory, potentially disclosing it to the attacker.(CVE-2015-8920)\n\nA vulnerability was found in libarchive. A specially crafted mtree file could cause libarchive to read beyond a statically declared structure, potentially disclosing application memory.(CVE-2015-8921)\n\nA vulnerability was found in libarchive. A specially crafted LZA/LZH file could cause a small out-of-bounds read, potentially disclosing a few bytes of application memory.(CVE-2015-8919)\n\nA vulnerability was found in libarchive. A specially crafted ISO file could cause the application to consume resources until it hit a memory limit, leading to a crash or denial of service.(CVE-2015-8930)\n\nA vulnerability was found in libarchive. A specially crafted TAR file could trigger an out-of-bounds read, potentially causing the application to disclose a small amount of application memory.(CVE-2015-8924)\n\nA vulnerability was found in libarchive. A specially crafted MTREE file could cause a limited out-of-bounds read, potentially disclosing contents of application memory.(CVE-2015-8928)\n\nA vulnerability was found in libarchive. A specially crafted CAB file could cause the application dereference a NULL pointer, leading to a crash.(CVE-2015-8917)\n\nA vulnerability was found in libarchive. A specially crafted RAR file could cause the application dereference a NULL pointer, leading to a crash.(CVE-2015-8916)\n\nA vulnerability was found in libarchive's hand ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'libarchive' package(s) on Huawei EulerOS Virtualization 3.0.1.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-3.0.1.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"ibarchive\", rpm:\"ibarchive~3.1.2~10.eulerosv2r7\", rls:\"EULEROSVIRT-3.0.1.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "prion": [{"lastseen": "2023-11-22T03:28:06", "description": "Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-07T10:59:00", "type": "prion", "title": "Heap overflow", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2018-01-05T02:30:00", "id": "PRION:CVE-2016-1541", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2016-1541", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2023-12-02T15:01:01", "description": "Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-07T10:59:00", "type": "cve", "title": "CVE-2016-1541", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2018-01-05T02:30:00", "cpe": ["cpe:/a:libarchive:libarchive:3.1.901a"], "id": "CVE-2016-1541", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1541", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:libarchive:libarchive:3.1.901a:*:*:*:*:*:*:*"]}], "freebsd": [{"lastseen": "2023-12-02T16:48:25", "description": "\n\nThe libarchive project reports:\n\nHeap-based buffer overflow in the zip_read_mac_metadata function\n\t in archive_read_support_format_zip.c in libarchive before 3.2.0\n\t allows remote attackers to execute arbitrary code via crafted\n\t entry-size values in a ZIP archive.\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-01T00:00:00", "type": "freebsd", "title": "libarchive -- RCE vulnerability", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-10T00:00:00", "id": "2B4C8E1F-1609-11E6-B55E-B499BAEBFEAF", "href": "https://vuxml.freebsd.org/freebsd/2b4c8e1f-1609-11e6-b55e-b499baebfeaf.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2023-12-03T17:03:08", "description": "fix manual pages to mention correctly spelled binary names (rhbz#1294252), fix CVE-2016-1541, rhbz#1334213\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-07-14T00:00:00", "type": "nessus", "title": "Fedora 22 : libarchive (2016-19c34099d3)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libarchive", "cpe:/o:fedoraproject:fedora:22"], "id": "FEDORA_2016-19C34099D3.NASL", "href": "https://www.tenable.com/plugins/nessus/92061", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2016-19c34099d3.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92061);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1541\");\n script_xref(name:\"FEDORA\", value:\"2016-19c34099d3\");\n\n script_name(english:\"Fedora 22 : libarchive (2016-19c34099d3)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"fix manual pages to mention correctly spelled binary names\n(rhbz#1294252), fix CVE-2016-1541, rhbz#1334213\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2016-19c34099d3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:22\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^22([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 22\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC22\", reference:\"libarchive-3.1.2-14.fc22\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libarchive\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:24:09", "description": "fix manual pages to mention correctly spelled binary names (rhbz#1294252), fix CVE-2016-1541, rhbz#1334213\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-07-14T00:00:00", "type": "nessus", "title": "Fedora 24 : libarchive (2016-760bd8b6a5)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libarchive", "cpe:/o:fedoraproject:fedora:24"], "id": "FEDORA_2016-760BD8B6A5.NASL", "href": "https://www.tenable.com/plugins/nessus/92112", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2016-760bd8b6a5.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92112);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1541\");\n script_xref(name:\"FEDORA\", value:\"2016-760bd8b6a5\");\n\n script_name(english:\"Fedora 24 : libarchive (2016-760bd8b6a5)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"fix manual pages to mention correctly spelled binary names\n(rhbz#1294252), fix CVE-2016-1541, rhbz#1334213\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2016-760bd8b6a5\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:24\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^24([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 24\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC24\", reference:\"libarchive-3.1.2-17.fc24\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libarchive\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:20:43", "description": "New libarchive packages are available for Slackware 14.1 and -current to fix a security issue.", "cvss3": {}, "published": "2016-05-25T00:00:00", "type": "nessus", "title": "Slackware 14.1 / current : libarchive (SSA:2016-145-01)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:slackware:slackware_linux:libarchive", "cpe:/o:slackware:slackware_linux", "cpe:/o:slackware:slackware_linux:14.1"], "id": "SLACKWARE_SSA_2016-145-01.NASL", "href": "https://www.tenable.com/plugins/nessus/91312", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2016-145-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91312);\n script_version(\"2.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2016-1541\");\n script_xref(name:\"SSA\", value:\"2016-145-01\");\n\n script_name(english:\"Slackware 14.1 / current : libarchive (SSA:2016-145-01)\");\n script_summary(english:\"Checks for updated package in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New libarchive packages are available for Slackware 14.1 and -current\nto fix a security issue.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.352685\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f3bb8127\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"14.1\", pkgname:\"libarchive\", pkgver:\"3.1.2\", pkgarch:\"i486\", pkgnum:\"2_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", arch:\"x86_64\", pkgname:\"libarchive\", pkgver:\"3.1.2\", pkgarch:\"x86_64\", pkgnum:\"2_slack14.1\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"libarchive\", pkgver:\"3.1.2\", pkgarch:\"i586\", pkgnum:\"3\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"libarchive\", pkgver:\"3.1.2\", pkgarch:\"x86_64\", pkgnum:\"3\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:21:21", "description": "The libarchive project reports :\n\nHeap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.", "cvss3": {}, "published": "2016-05-11T00:00:00", "type": "nessus", "title": "FreeBSD : libarchive -- RCE vulnerability (2b4c8e1f-1609-11e6-b55e-b499baebfeaf)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:libarchive", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_2B4C8E1F160911E6B55EB499BAEBFEAF.NASL", "href": "https://www.tenable.com/plugins/nessus/91026", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91026);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2016-1541\");\n\n script_name(english:\"FreeBSD : libarchive -- RCE vulnerability (2b4c8e1f-1609-11e6-b55e-b499baebfeaf)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The libarchive project reports :\n\nHeap-based buffer overflow in the zip_read_mac_metadata function in\narchive_read_support_format_zip.c in libarchive before 3.2.0 allows\nremote attackers to execute arbitrary code via crafted entry-size\nvalues in a ZIP archive.\"\n );\n # https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?865fee28\"\n );\n # https://vuxml.freebsd.org/freebsd/2b4c8e1f-1609-11e6-b55e-b499baebfeaf.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?61396c59\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"libarchive<3.2.0,1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-03T17:00:24", "description": "Rock Stevens, Andrew Ruef and Marcin 'Icewall' Noga discovered a heap-based buffer overflow vulnerability in the zip_read_mac_metadata function in libarchive, a multi-format archive and compression library, which may lead to the execution of arbitrary code if a user or automated system is tricked into processing a specially crafted ZIP file.", "cvss3": {}, "published": "2016-05-12T00:00:00", "type": "nessus", "title": "Debian DSA-3574-1 : libarchive - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libarchive", "cpe:/o:debian:debian_linux:8.0"], "id": "DEBIAN_DSA-3574.NASL", "href": "https://www.tenable.com/plugins/nessus/91052", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3574. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91052);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1541\");\n script_xref(name:\"DSA\", value:\"3574\");\n\n script_name(english:\"Debian DSA-3574-1 : libarchive - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Rock Stevens, Andrew Ruef and Marcin 'Icewall' Noga discovered a\nheap-based buffer overflow vulnerability in the zip_read_mac_metadata\nfunction in libarchive, a multi-format archive and compression\nlibrary, which may lead to the execution of arbitrary code if a user\nor automated system is tricked into processing a specially crafted ZIP\nfile.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823893\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/libarchive\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2016/dsa-3574\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the libarchive packages.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 3.1.2-11+deb8u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"bsdcpio\", reference:\"3.1.2-11+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"bsdtar\", reference:\"3.1.2-11+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libarchive-dev\", reference:\"3.1.2-11+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libarchive13\", reference:\"3.1.2-11+deb8u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:21:13", "description": "It was discovered that libarchive incorrectly handled certain entry-size values in ZIP archives. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-1541)\n\nIt was discovered that libarchive incorrectly handled memory when processing certain tar files. A remote attacker could use this issue to cuase libarchive to crash, resulting in a denial of service. (CVE number pending).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-05-18T00:00:00", "type": "nessus", "title": "Ubuntu 14.04 LTS / 16.04 LTS : libarchive vulnerabilities (USN-2981-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2023-10-20T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libarchive13", "cpe:/o:canonical:ubuntu_linux:14.04:-:lts", "cpe:/o:canonical:ubuntu_linux:16.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:bsdcpio", "p-cpe:/a:canonical:ubuntu_linux:bsdtar", "p-cpe:/a:canonical:ubuntu_linux:libarchive-dev"], "id": "UBUNTU_USN-2981-1.NASL", "href": "https://www.tenable.com/plugins/nessus/91219", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2981-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91219);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/20\");\n\n script_cve_id(\"CVE-2016-1541\");\n script_xref(name:\"USN\", value:\"2981-1\");\n\n script_name(english:\"Ubuntu 14.04 LTS / 16.04 LTS : libarchive vulnerabilities (USN-2981-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"It was discovered that libarchive incorrectly handled certain\nentry-size values in ZIP archives. A remote attacker could use this\nissue to cause libarchive to crash, resulting in a denial of service,\nor possibly execute arbitrary code. This issue only applied to Ubuntu\n14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-1541)\n\nIt was discovered that libarchive incorrectly handled memory when\nprocessing certain tar files. A remote attacker could use this issue\nto cuase libarchive to crash, resulting in a denial of service. (CVE\nnumber pending).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-2981-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-1541\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/05/18\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libarchive13\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:bsdcpio\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libarchive-dev\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2023 Canonical, Inc. / NASL script (C) 2016-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/Ubuntu/release');\nif ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nos_release = chomp(os_release);\nif (! ('14.04' >< os_release || '16.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 14.04 / 16.04', 'Ubuntu ' + os_release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar pkgs = [\n {'osver': '14.04', 'pkgname': 'bsdcpio', 'pkgver': '3.1.2-7ubuntu2.2'},\n {'osver': '14.04', 'pkgname': 'bsdtar', 'pkgver': '3.1.2-7ubuntu2.2'},\n {'osver': '14.04', 'pkgname': 'libarchive-dev', 'pkgver': '3.1.2-7ubuntu2.2'},\n {'osver': '14.04', 'pkgname': 'libarchive13', 'pkgver': '3.1.2-7ubuntu2.2'},\n {'osver': '16.04', 'pkgname': 'bsdcpio', 'pkgver': '3.1.2-11ubuntu0.16.04.1'},\n {'osver': '16.04', 'pkgname': 'bsdtar', 'pkgver': '3.1.2-11ubuntu0.16.04.1'},\n {'osver': '16.04', 'pkgname': 'libarchive-dev', 'pkgver': '3.1.2-11ubuntu0.16.04.1'},\n {'osver': '16.04', 'pkgname': 'libarchive13', 'pkgver': '3.1.2-11ubuntu0.16.04.1'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var osver = NULL;\n var pkgname = NULL;\n var pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'bsdcpio / bsdtar / libarchive-dev / libarchive13');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:21:40", "description": "This update for libarchive fixes the following issue :\n\n - Fix a heap-based buffer overflow (CVE-2016-1541, bsc#979005)", "cvss3": {}, "published": "2016-06-06T00:00:00", "type": "nessus", "title": "openSUSE Security Update : libarchive (openSUSE-2016-670)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:bsdtar", "p-cpe:/a:novell:opensuse:bsdtar-debuginfo", "p-cpe:/a:novell:opensuse:libarchive-debugsource", "p-cpe:/a:novell:opensuse:libarchive-devel", "p-cpe:/a:novell:opensuse:libarchive13", "p-cpe:/a:novell:opensuse:libarchive13-32bit", "p-cpe:/a:novell:opensuse:libarchive13-debuginfo", "p-cpe:/a:novell:opensuse:libarchive13-debuginfo-32bit", "cpe:/o:novell:opensuse:13.2"], "id": "OPENSUSE-2016-670.NASL", "href": "https://www.tenable.com/plugins/nessus/91482", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-670.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91482);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-1541\");\n\n script_name(english:\"openSUSE Security Update : libarchive (openSUSE-2016-670)\");\n script_summary(english:\"Check for the openSUSE-2016-670 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libarchive fixes the following issue :\n\n - Fix a heap-based buffer overflow (CVE-2016-1541,\n bsc#979005)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=979005\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:bsdtar-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/06/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"bsdtar-3.1.2-7.8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"bsdtar-debuginfo-3.1.2-7.8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libarchive-debugsource-3.1.2-7.8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libarchive-devel-3.1.2-7.8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libarchive13-3.1.2-7.8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libarchive13-debuginfo-3.1.2-7.8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libarchive13-32bit-3.1.2-7.8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libarchive13-debuginfo-32bit-3.1.2-7.8.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bsdtar / bsdtar-debuginfo / libarchive-debugsource / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:22:29", "description": "This update for libarchive fixes the following issue :\n\n - Fix a heap-based buffer overflow (CVE-2016-1541, bsc#979005)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-06-17T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : libarchive (SUSE-SU-2016:1588-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libarchive-debugsource", "p-cpe:/a:novell:suse_linux:libarchive13", "p-cpe:/a:novell:suse_linux:libarchive13-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-1588-1.NASL", "href": "https://www.tenable.com/plugins/nessus/91667", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:1588-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91667);\n script_version(\"2.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2016-1541\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : libarchive (SUSE-SU-2016:1588-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libarchive fixes the following issue :\n\n - Fix a heap-based buffer overflow (CVE-2016-1541,\n bsc#979005)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=979005\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1541/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20161588-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?cdfec3a4\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12-SP1 :\n\nzypper in -t patch SUSE-SLE-SDK-12-SP1-2016-940=1\n\nSUSE Linux Enterprise Software Development Kit 12 :\n\nzypper in -t patch SUSE-SLE-SDK-12-2016-940=1\n\nSUSE Linux Enterprise Server 12-SP1 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-940=1\n\nSUSE Linux Enterprise Server 12 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-2016-940=1\n\nSUSE Linux Enterprise Desktop 12-SP1 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-940=1\n\nSUSE Linux Enterprise Desktop 12 :\n\nzypper in -t patch SUSE-SLE-DESKTOP-12-2016-940=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libarchive-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libarchive13\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libarchive13-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/06/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0|1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0/1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(0|1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP0/1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libarchive-debugsource-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libarchive13-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libarchive13-debuginfo-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libarchive-debugsource-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libarchive13-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libarchive13-debuginfo-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"libarchive-debugsource-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"libarchive13-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"libarchive13-debuginfo-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"libarchive-debugsource-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"libarchive13-3.1.2-12.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"0\", cpu:\"x86_64\", reference:\"libarchive13-debuginfo-3.1.2-12.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libarchive\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:22:16", "description": "This update for libarchive fixes the following issue :\n\n - Fix a heap-based buffer overflow (CVE-2016-1541, bsc#979005)\n\nThis update was imported from the SUSE:SLE-12:Update update project.", "cvss3": {}, "published": "2016-06-24T00:00:00", "type": "nessus", "title": "openSUSE Security Update : libarchive (openSUSE-2016-762)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:bsdtar", "p-cpe:/a:novell:opensuse:bsdtar-debuginfo", "p-cpe:/a:novell:opensuse:libarchive-debugsource", "p-cpe:/a:novell:opensuse:libarchive-devel", "p-cpe:/a:novell:opensuse:libarchive13", "p-cpe:/a:novell:opensuse:libarchive13-32bit", "p-cpe:/a:novell:opensuse:libarchive13-debuginfo", "p-cpe:/a:novell:opensuse:libarchive13-debuginfo-32bit", "cpe:/o:novell:opensuse:42.1"], "id": "OPENSUSE-2016-762.NASL", "href": "https://www.tenable.com/plugins/nessus/91795", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-762.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(91795);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2016-1541\");\n\n script_name(english:\"openSUSE Security Update : libarchive (openSUSE-2016-762)\");\n script_summary(english:\"Check for the openSUSE-2016-762 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libarchive fixes the following issue :\n\n - Fix a heap-based buffer overflow (CVE-2016-1541,\n bsc#979005)\n\nThis update was imported from the SUSE:SLE-12:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=979005\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:bsdtar-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libarchive13-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/06/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/06/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"bsdtar-3.1.2-10.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"bsdtar-debuginfo-3.1.2-10.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libarchive-debugsource-3.1.2-10.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libarchive-devel-3.1.2-10.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libarchive13-3.1.2-10.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libarchive13-debuginfo-3.1.2-10.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"libarchive13-32bit-3.1.2-10.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"libarchive13-debuginfo-32bit-3.1.2-10.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bsdtar / bsdtar-debuginfo / libarchive-debugsource / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:23:49", "description": "fix manual pages to mention correctly spelled binary names (rhbz#1294252), fix CVE-2016-1541, rhbz#1334213\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2016-07-14T00:00:00", "type": "nessus", "title": "Fedora 23 : libarchive (2016-8491ec1ebd)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libarchive", "cpe:/o:fedoraproject:fedora:23"], "id": "FEDORA_2016-8491EC1EBD.NASL", "href": "https://www.tenable.com/plugins/nessus/92122", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2016-8491ec1ebd.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(92122);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2016-1541\");\n script_xref(name:\"FEDORA\", value:\"2016-8491ec1ebd\");\n\n script_name(english:\"Fedora 23 : libarchive (2016-8491ec1ebd)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"fix manual pages to mention correctly spelled binary names\n(rhbz#1294252), fix CVE-2016-1541, rhbz#1334213\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2016-8491ec1ebd\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:23\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/05/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^23([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 23\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC23\", reference:\"libarchive-3.1.2-15.fc23\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libarchive\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:25:29", "description": "According to its self-reported version number, the version of Splunk Enterprise hosted on the remote web server is 5.0.x, 6.0.x prior to 6.0.12, 6.1.x prior to 6.1.11, 6.2.x prior to 6.2.11, 6.3.x prior to 6.3.6, or 6.4.x prior to 6.4.2; or else it is Splunk Light version 6.4.x prior to 6.4.2. It is, therefore, affected by the following vulnerabilities :\n\n - An integer signedness error exists in libarchive in the archive_write_zip_data() function within file archive_write_set_format_zip.c due to improper conversion between unsigned and signed integer types when running on 64-bit CPUs. An unauthenticated, remote attacker can exploit this to cause a buffer overflow, resulting in a denial of service condition.\n (CVE-2013-0211)\n\n - A path traversal vulnerability exists in libarchive in the bsdcpio() function within file in cpio/cpio.c due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted path in an archive, to write to arbitrary files. (CVE-2015-2304)\n\n - A heap-based buffer overflow condition exists in libarchive in the zip_read_mac_metadata() function within file archive_read_support_format_zip.c due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via specially crafted entry-size values in a ZIP archive, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1541)\n\n - Multiple flaws exist in the OpenSSL library in the aesni_cbc_hmac_sha1_cipher() function in file crypto/evp/e_aes_cbc_hmac_sha1.c and the aesni_cbc_hmac_sha256_cipher() function in file crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered when the connection uses an AES-CBC cipher and AES-NI is supported by the server. A man-in-the-middle attacker can exploit these to conduct a padding oracle attack, resulting in the ability to decrypt the network traffic.\n (CVE-2016-2107)\n\n - An unspecified cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in the user's browser session.\n\n - An unspecified cross-site redirection vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted web link, to redirect the browser to an arbitrary website of the attacker's own choosing.\n\nNote that Splunk Enterprise 5.0.x will not be patched for OpenSSL issues, and it is recommended you upgrade to the latest version.\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2016-08-08T00:00:00", "type": "nessus", "title": "Splunk Enterprise < 5.0.16 / 6.0.12 / 6.1.11 / 6.2.11 / 6.3.6 / 6.4.2 or Splunk Light < 6.4.2 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-0211", "CVE-2015-2304", "CVE-2016-1541", "CVE-2016-2107"], "modified": "2019-11-14T00:00:00", "cpe": ["cpe:/a:splunk:splunk", "cpe:/a:openssl:openssl", "cpe:/a:libarchive:libarchive"], "id": "SPLUNK_642.NASL", "href": "https://www.tenable.com/plugins/nessus/92790", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(92790);\n script_version(\"1.7\");\n script_cvs_date(\"Date: 2019/11/14\");\n\n script_cve_id(\n \"CVE-2013-0211\",\n \"CVE-2015-2304\",\n \"CVE-2016-1541\",\n \"CVE-2016-2107\"\n );\n script_bugtraq_id(\n 58926,\n 89355,\n 89760,\n 92183,\n 92184\n );\n script_xref(name:\"CERT\", value:\"862384\");\n script_xref(name:\"EDB-ID\", value:\"39768\");\n\n script_name(english:\"Splunk Enterprise < 5.0.16 / 6.0.12 / 6.1.11 / 6.2.11 / 6.3.6 / 6.4.2 or Splunk Light < 6.4.2 Multiple Vulnerabilities\");\n script_summary(english:\"Checks the version of Splunk Enterprise and Light.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"An application running on the remote web server is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version number, the version of Splunk\nEnterprise hosted on the remote web server is 5.0.x, 6.0.x prior to\n6.0.12, 6.1.x prior to 6.1.11, 6.2.x prior to 6.2.11, 6.3.x prior to\n6.3.6, or 6.4.x prior to 6.4.2; or else it is Splunk Light version\n6.4.x prior to 6.4.2. It is, therefore, affected by the following\nvulnerabilities :\n\n - An integer signedness error exists in libarchive in the\n archive_write_zip_data() function within file\n archive_write_set_format_zip.c due to improper\n conversion between unsigned and signed integer types\n when running on 64-bit CPUs. An unauthenticated, remote\n attacker can exploit this to cause a buffer overflow,\n resulting in a denial of service condition.\n (CVE-2013-0211)\n\n - A path traversal vulnerability exists in libarchive in\n the bsdcpio() function within file in cpio/cpio.c due to\n improper sanitization of user-supplied input. An\n unauthenticated, remote attacker can exploit this, via\n a specially crafted path in an archive, to write to\n arbitrary files. (CVE-2015-2304)\n\n - A heap-based buffer overflow condition exists in\n libarchive in the zip_read_mac_metadata() function\n within file archive_read_support_format_zip.c due to\n improper sanitization of user-supplied input. An\n unauthenticated, remote attacker can exploit this, via\n specially crafted entry-size values in a ZIP archive, to\n cause a denial of service condition or the execution of\n arbitrary code. (CVE-2016-1541)\n\n - Multiple flaws exist in the OpenSSL library in the\n aesni_cbc_hmac_sha1_cipher() function in file\n crypto/evp/e_aes_cbc_hmac_sha1.c and the\n aesni_cbc_hmac_sha256_cipher() function in file\n crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered\n when the connection uses an AES-CBC cipher and AES-NI\n is supported by the server. A man-in-the-middle attacker\n can exploit these to conduct a padding oracle attack,\n resulting in the ability to decrypt the network traffic.\n (CVE-2016-2107)\n\n - An unspecified cross-site scripting (XSS) vulnerability\n exists due to improper validation of user-supplied\n input. An unauthenticated, remote attacker can exploit\n this, via a specially crafted request, to execute\n arbitrary script code in the user's browser session.\n\n - An unspecified cross-site redirection vulnerability\n exists due to improper validation of user-supplied\n input. An unauthenticated, remote attacker can exploit\n this, by convincing a user to visit a specially crafted\n web link, to redirect the browser to an arbitrary\n website of the attacker's own choosing.\n\nNote that Splunk Enterprise 5.0.x will not be patched for OpenSSL\nissues, and it is recommended you upgrade to the latest version.\n\nNote that Nessus has not tested for these issues but has instead\nrelied only on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.splunk.com/view/SP-CAAAPQM\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.openssl.org/news/secadv/20160503.txt\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade Splunk Enterprise to version 6.0.12 / 6.1.11 / 6.2.11 /\n6.3.6 / 6.4.2 or later, or Splunk Light to version 6.4.2 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/03/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/08/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:splunk:splunk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:openssl:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:libarchive:libarchive\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"splunkd_detect.nasl\", \"splunk_web_detect.nasl\");\n script_require_keys(\"installed_sw/Splunk\");\n script_require_ports(\"Services/www\", 8089, 8000);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"install_func.inc\");\n\napp = \"Splunk\";\n\nget_install_count(app_name:app, exit_if_zero:TRUE);\n\nport = get_http_port(default:8000, embedded:TRUE);\n\ninstall = get_single_install(\n app_name : app,\n port : port,\n exit_if_unknown_ver : TRUE\n);\n\ndir = install['path'];\nver = install['version'];\nlicense = install['License'];\nfix = FALSE;\n\ninstall_url = build_url(qs:dir, port:port);\n\nnote = NULL;\nif (license == \"Enterprise\")\n{\n # 5.0.x < 5.0.16\n # Splunk Enterprise 5.0.x will not be patched for OpenSSL issues.\n # Splunk recommends updating to the latest version of Splunk Enterprise.\n if (ver =~ \"^5\\.0($|[^0-9])\")\n fix = '6.4.2';\n\n # 6.0.x < 6.0.12\n else if (ver =~ \"^6\\.0($|[^0-9])\")\n fix = '6.0.12';\n\n # 6.1.x < 6.1.11\n else if (ver =~ \"^6\\.1($|[^0-9])\")\n fix = '6.1.11';\n\n # 6.2.x < 6.2.11\n else if (ver =~ \"^6\\.2($|[^0-9])\")\n fix = '6.2.11';\n\n # 6.3.x < 6.3.6\n else if (ver =~ \"^6\\.3($|[^0-9])\")\n fix = '6.3.6';\n\n # 6.4.x < 6.4.2\n else if (ver =~ \"^6\\.4($|[^0-9])\")\n fix = '6.4.2';\n}\nelse if (license == \"Light\")\n{\n # any < 6.4.2\n fix = '6.4.2';\n}\n\nif (fix && ver_compare(ver:ver,fix:fix,strict:FALSE) < 0)\n{\n order = make_list(\"URL\", \"Installed version\", \"Fixed version\");\n report = make_array(\n order[0], install_url,\n order[1], ver + \" \" + license,\n order[2], fix + \" \" + license\n );\n report = report_items_str(report_items:report, ordered_fields:order);\n\n security_report_v4(port:port, extra:report, severity:SECURITY_WARNING, xss:TRUE);\n exit(0);\n}\nelse audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, ver + \" \" + license);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-01T14:55:52", "description": "An update for libarchive is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es) :\n\n* A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive.\nSpecially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive.\nSpecially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting CVE-2016-5418.", "cvss3": {}, "published": "2016-09-13T00:00:00", "type": "nessus", "title": "RHEL 7 : libarchive (RHSA-2016:1844)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2019-10-24T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:bsdcpio", "p-cpe:/a:redhat:enterprise_linux:bsdtar", "p-cpe:/a:redhat:enterprise_linux:libarchive", "p-cpe:/a:redhat:enterprise_linux:libarchive-debuginfo", "p-cpe:/a:redhat:enterprise_linux:libarchive-devel", "cpe:/o:redhat:enterprise_linux:7", "cpe:/o:redhat:enterprise_linux:7.2", "cpe:/o:redhat:enterprise_linux:7.3", "cpe:/o:redhat:enterprise_linux:7.4", "cpe:/o:redhat:enterprise_linux:7.5", "cpe:/o:redhat:enterprise_linux:7.6", "cpe:/o:redhat:enterprise_linux:7.7"], "id": "REDHAT-RHSA-2016-1844.NASL", "href": "https://www.tenable.com/plugins/nessus/93450", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:1844. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93450);\n script_version(\"2.14\");\n script_cvs_date(\"Date: 2019/10/24 15:35:41\");\n\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_xref(name:\"RHSA\", value:\"2016:1844\");\n\n script_name(english:\"RHEL 7 : libarchive (RHSA-2016:1844)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for libarchive is now available for Red Hat Enterprise Linux\n7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe libarchive programming library can create and read several\ndifferent streaming archive formats, including GNU tar, cpio, and ISO\n9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,\nscripting language bindings such as python-libarchive, and several\npopular desktop file managers.\n\nSecurity Fix(es) :\n\n* A flaw was found in the way libarchive handled hardlink archive\nentries of non-zero size. Combined with flaws in libarchive's file\nsystem sandboxing, this issue could cause an application using\nlibarchive to overwrite arbitrary files with arbitrary data from the\narchive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive.\nSpecially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow,\npotentially allowing code execution in the context of the application\nusing libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive.\nSpecially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could\ncause the application to read data out of bounds, potentially\ndisclosing a small amount of application memory, or causing an\napplication crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921,\nCVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926,\nCVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application\nusing libarchive to crash. (CVE-2015-8916, CVE-2015-8917,\nCVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in\nlibarchive. Specially crafted GZIP or ISO files could cause the\napplication to consume an excessive amount of resources, eventually\nleading to a crash on memory exhaustion. (CVE-2016-7166,\nCVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A\nspecially crafted CPIO archive containing a symbolic link to a large\ntarget path could cause memory allocation to fail, causing an\napplication using libarchive that attempted to view or extract such\narchive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in\nlibarchive's construction of ISO9660 volumes. Attempting to create an\nISO9660 volume with 2 GB or 4 GB file names could cause the\napplication to attempt to allocate 20 GB of memory. If this were to\nsucceed, it could lead to an out of bounds write on the heap and\npotential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow\nwere found in libarchive. Specially crafted MTREE archives, Compress\nstreams, or ISO9660 volumes could potentially cause the application to\nfail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932,\nCVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting\nCVE-2016-5418.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2016:1844\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8916\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8917\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8920\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8921\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8922\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8923\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8924\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8925\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8926\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8928\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8930\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8931\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8932\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2015-8934\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-1541\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-4300\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-4302\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-4809\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-5418\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-5844\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-6250\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2016-7166\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:bsdcpio\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libarchive-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libarchive-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2016:1844\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"bsdcpio-3.1.2-10.el7_2\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"bsdcpio-3.1.2-10.el7_2\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"bsdtar-3.1.2-10.el7_2\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"bsdtar-3.1.2-10.el7_2\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"libarchive-3.1.2-10.el7_2\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"libarchive-debuginfo-3.1.2-10.el7_2\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"libarchive-devel-3.1.2-10.el7_2\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bsdcpio / bsdtar / libarchive / libarchive-debuginfo / etc\");\n }\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:32:59", "description": "According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\n - Multiple out-of-bounds write flaws were found in libarchive.\n\n - Specially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive.\n (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n - Multiple out-of-bounds read flaws were found in libarchive.\n\n - Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash.\n (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n - Multiple NULL pointer dereference flaws were found in libarchive.\n\n - Specially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash.\n (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n - Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n - A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\n - An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\n - Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2017-05-01T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP1 : libarchive (EulerOS-SA-2016-1045)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:libarchive", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2016-1045.NASL", "href": "https://www.tenable.com/plugins/nessus/99808", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(99808);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2015-8916\",\n \"CVE-2015-8917\",\n \"CVE-2015-8919\",\n \"CVE-2015-8920\",\n \"CVE-2015-8921\",\n \"CVE-2015-8922\",\n \"CVE-2015-8923\",\n \"CVE-2015-8924\",\n \"CVE-2015-8925\",\n \"CVE-2015-8926\",\n \"CVE-2015-8928\",\n \"CVE-2015-8930\",\n \"CVE-2015-8931\",\n \"CVE-2015-8932\",\n \"CVE-2015-8934\",\n \"CVE-2016-1541\",\n \"CVE-2016-4300\",\n \"CVE-2016-4302\",\n \"CVE-2016-4809\",\n \"CVE-2016-5418\",\n \"CVE-2016-5844\",\n \"CVE-2016-6250\",\n \"CVE-2016-7166\"\n );\n\n script_name(english:\"EulerOS 2.0 SP1 : libarchive (EulerOS-SA-2016-1045)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the libarchive package installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - A flaw was found in the way libarchive handled hardlink\n archive entries of non-zero size. Combined with flaws\n in libarchive's file system sandboxing, this issue\n could cause an application using libarchive to\n overwrite arbitrary files with arbitrary data from the\n archive. (CVE-2016-5418)\n\n - Multiple out-of-bounds write flaws were found in\n libarchive.\n\n - Specially crafted ZIP, 7ZIP, or RAR files could cause a\n heap overflow, potentially allowing code execution in\n the context of the application using libarchive.\n (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n - Multiple out-of-bounds read flaws were found in\n libarchive.\n\n - Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR\n files could cause the application to read data out of\n bounds, potentially disclosing a small amount of\n application memory, or causing an application crash.\n (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921,\n CVE-2015-8923, CVE-2015-8924, CVE-2015-8925,\n CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n - Multiple NULL pointer dereference flaws were found in\n libarchive.\n\n - Specially crafted RAR, CAB, or 7ZIP files could cause\n an application using libarchive to crash.\n (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n - Multiple infinite loop / resource exhaustion flaws were\n found in libarchive. Specially crafted GZIP or ISO\n files could cause the application to consume an\n excessive amount of resources, eventually leading to a\n crash on memory exhaustion. (CVE-2016-7166,\n CVE-2015-8930)\n\n - A denial of service vulnerability was found in\n libarchive. A specially crafted CPIO archive containing\n a symbolic link to a large target path could cause\n memory allocation to fail, causing an application using\n libarchive that attempted to view or extract such\n archive to crash. (CVE-2016-4809)\n\n - An integer overflow flaw, leading to a buffer overflow,\n was found in libarchive's construction of ISO9660\n volumes. Attempting to create an ISO9660 volume with 2\n GB or 4 GB file names could cause the application to\n attempt to allocate 20 GB of memory. If this were to\n succeed, it could lead to an out of bounds write on the\n heap and potential code execution. (CVE-2016-6250)\n\n - Multiple instances of undefined behavior due to\n arithmetic overflow were found in libarchive. Specially\n crafted MTREE archives, Compress streams, or ISO9660\n volumes could potentially cause the application to fail\n to read the archive, or to crash. (CVE-2015-8931,\n CVE-2015-8932, CVE-2016-5844)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2016-1045\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?1ccda519\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libarchive packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/05/01\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(1)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"libarchive-3.1.2-10\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"1\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libarchive\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:26:50", "description": "Security Fix(es) :\n\n - A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive.\n (CVE-2016-5418)\n\n - Multiple out-of-bounds write flaws were found in libarchive. Specially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n - Multiple out-of-bounds read flaws were found in libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n - Multiple NULL pointer dereference flaws were found in libarchive. Specially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash.\n (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n - Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n - A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\n - An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\n - Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)", "cvss3": {}, "published": "2016-09-13T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : libarchive on SL7.x x86_64 (20160912)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:fermilab:scientific_linux:bsdcpio", "p-cpe:/a:fermilab:scientific_linux:bsdtar", "p-cpe:/a:fermilab:scientific_linux:libarchive", "p-cpe:/a:fermilab:scientific_linux:libarchive-debuginfo", "p-cpe:/a:fermilab:scientific_linux:libarchive-devel", "x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20160912_LIBARCHIVE_ON_SL7_X.NASL", "href": "https://www.tenable.com/plugins/nessus/93454", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93454);\n script_version(\"2.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n\n script_name(english:\"Scientific Linux Security Update : libarchive on SL7.x x86_64 (20160912)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security Fix(es) :\n\n - A flaw was found in the way libarchive handled hardlink\n archive entries of non-zero size. Combined with flaws in\n libarchive's file system sandboxing, this issue could\n cause an application using libarchive to overwrite\n arbitrary files with arbitrary data from the archive.\n (CVE-2016-5418)\n\n - Multiple out-of-bounds write flaws were found in\n libarchive. Specially crafted ZIP, 7ZIP, or RAR files\n could cause a heap overflow, potentially allowing code\n execution in the context of the application using\n libarchive. (CVE-2016-1541, CVE-2016-4300,\n CVE-2016-4302)\n\n - Multiple out-of-bounds read flaws were found in\n libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP,\n TAR, or RAR files could cause the application to read\n data out of bounds, potentially disclosing a small\n amount of application memory, or causing an application\n crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921,\n CVE-2015-8923, CVE-2015-8924, CVE-2015-8925,\n CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n - Multiple NULL pointer dereference flaws were found in\n libarchive. Specially crafted RAR, CAB, or 7ZIP files\n could cause an application using libarchive to crash.\n (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n - Multiple infinite loop / resource exhaustion flaws were\n found in libarchive. Specially crafted GZIP or ISO files\n could cause the application to consume an excessive\n amount of resources, eventually leading to a crash on\n memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n - A denial of service vulnerability was found in\n libarchive. A specially crafted CPIO archive containing\n a symbolic link to a large target path could cause\n memory allocation to fail, causing an application using\n libarchive that attempted to view or extract such\n archive to crash. (CVE-2016-4809)\n\n - An integer overflow flaw, leading to a buffer overflow,\n was found in libarchive's construction of ISO9660\n volumes. Attempting to create an ISO9660 volume with 2\n GB or 4 GB file names could cause the application to\n attempt to allocate 20 GB of memory. If this were to\n succeed, it could lead to an out of bounds write on the\n heap and potential code execution. (CVE-2016-6250)\n\n - Multiple instances of undefined behavior due to\n arithmetic overflow were found in libarchive. Specially\n crafted MTREE archives, Compress streams, or ISO9660\n volumes could potentially cause the application to fail\n to read the archive, or to crash. (CVE-2015-8931,\n CVE-2015-8932, CVE-2016-5844)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1609&L=scientific-linux-errata&F=&S=&P=1167\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a3fd90f0\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:bsdcpio\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libarchive-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fermilab:scientific_linux:libarchive-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nos_ver = pregmatch(pattern: \"Scientific Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Scientific Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Scientific Linux 7.x\", \"Scientific Linux \" + os_ver);\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"bsdcpio-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"bsdtar-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libarchive-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libarchive-debuginfo-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"SL7\", cpu:\"x86_64\", reference:\"libarchive-devel-3.1.2-10.el7_2\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bsdcpio / bsdtar / libarchive / libarchive-debuginfo / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:26:25", "description": "An update for libarchive is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es) :\n\n* A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive.\nSpecially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive.\nSpecially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting CVE-2016-5418.", "cvss3": {}, "published": "2016-09-16T00:00:00", "type": "nessus", "title": "CentOS 7 : libarchive (CESA-2016:1844)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos:bsdcpio", "p-cpe:/a:centos:centos:bsdtar", "p-cpe:/a:centos:centos:libarchive", "p-cpe:/a:centos:centos:libarchive-devel", "cpe:/o:centos:centos:7"], "id": "CENTOS_RHSA-2016-1844.NASL", "href": "https://www.tenable.com/plugins/nessus/93541", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2016:1844 and \n# CentOS Errata and Security Advisory 2016:1844 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93541);\n script_version(\"2.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_xref(name:\"RHSA\", value:\"2016:1844\");\n\n script_name(english:\"CentOS 7 : libarchive (CESA-2016:1844)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for libarchive is now available for Red Hat Enterprise Linux\n7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe libarchive programming library can create and read several\ndifferent streaming archive formats, including GNU tar, cpio, and ISO\n9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,\nscripting language bindings such as python-libarchive, and several\npopular desktop file managers.\n\nSecurity Fix(es) :\n\n* A flaw was found in the way libarchive handled hardlink archive\nentries of non-zero size. Combined with flaws in libarchive's file\nsystem sandboxing, this issue could cause an application using\nlibarchive to overwrite arbitrary files with arbitrary data from the\narchive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive.\nSpecially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow,\npotentially allowing code execution in the context of the application\nusing libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive.\nSpecially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could\ncause the application to read data out of bounds, potentially\ndisclosing a small amount of application memory, or causing an\napplication crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921,\nCVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926,\nCVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application\nusing libarchive to crash. (CVE-2015-8916, CVE-2015-8917,\nCVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in\nlibarchive. Specially crafted GZIP or ISO files could cause the\napplication to consume an excessive amount of resources, eventually\nleading to a crash on memory exhaustion. (CVE-2016-7166,\nCVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A\nspecially crafted CPIO archive containing a symbolic link to a large\ntarget path could cause memory allocation to fail, causing an\napplication using libarchive that attempted to view or extract such\narchive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in\nlibarchive's construction of ISO9660 volumes. Attempting to create an\nISO9660 volume with 2 GB or 4 GB file names could cause the\napplication to attempt to allocate 20 GB of memory. If this were to\nsucceed, it could lead to an out of bounds write on the heap and\npotential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow\nwere found in libarchive. Specially crafted MTREE archives, Compress\nstreams, or ISO9660 volumes could potentially cause the application to\nfail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932,\nCVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting\nCVE-2016-5418.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2016-September/022073.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a730f1a2\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2016-6250\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:bsdcpio\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libarchive-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 7.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"bsdcpio-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"bsdtar-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"libarchive-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"libarchive-devel-3.1.2-10.el7_2\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bsdcpio / bsdtar / libarchive / libarchive-devel\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:27:38", "description": "A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\nMultiple out-of-bounds write flaws were found in libarchive. Specially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541 , CVE-2016-4300 , CVE-2016-4302)\n\nMultiple out-of-bounds read flaws were found in libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash.\n(CVE-2015-8919 , CVE-2015-8920 , CVE-2015-8921 , CVE-2015-8923 , CVE-2015-8924 , CVE-2015-8925 , CVE-2015-8926 , CVE-2015-8928 , CVE-2015-8934)\n\nMultiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916 , CVE-2015-8917 , CVE-2015-8922)\n\nMultiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166 , CVE-2015-8930)\n\nA denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash.\n(CVE-2016-4809)\n\nAn integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\nMultiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931 , CVE-2015-8932 , CVE-2016-5844)", "cvss3": {}, "published": "2016-09-28T00:00:00", "type": "nessus", "title": "Amazon Linux AMI : libarchive (ALAS-2016-743)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2019-07-10T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:bsdcpio", "p-cpe:/a:amazon:linux:bsdtar", "p-cpe:/a:amazon:linux:libarchive", "p-cpe:/a:amazon:linux:libarchive-debuginfo", "p-cpe:/a:amazon:linux:libarchive-devel", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2016-743.NASL", "href": "https://www.tenable.com/plugins/nessus/93744", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2016-743.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(93744);\n script_version(\"2.4\");\n script_cvs_date(\"Date: 2019/07/10 16:04:12\");\n\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_xref(name:\"ALAS\", value:\"2016-743\");\n\n script_name(english:\"Amazon Linux AMI : libarchive (ALAS-2016-743)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A flaw was found in the way libarchive handled hardlink archive\nentries of non-zero size. Combined with flaws in libarchive's file\nsystem sandboxing, this issue could cause an application using\nlibarchive to overwrite arbitrary files with arbitrary data from the\narchive. (CVE-2016-5418)\n\nMultiple out-of-bounds write flaws were found in libarchive. Specially\ncrafted ZIP, 7ZIP, or RAR files could cause a heap overflow,\npotentially allowing code execution in the context of the application\nusing libarchive. (CVE-2016-1541 , CVE-2016-4300 , CVE-2016-4302)\n\nMultiple out-of-bounds read flaws were found in libarchive. Specially\ncrafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the\napplication to read data out of bounds, potentially disclosing a small\namount of application memory, or causing an application crash.\n(CVE-2015-8919 , CVE-2015-8920 , CVE-2015-8921 , CVE-2015-8923 ,\nCVE-2015-8924 , CVE-2015-8925 , CVE-2015-8926 , CVE-2015-8928 ,\nCVE-2015-8934)\n\nMultiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application\nusing libarchive to crash. (CVE-2015-8916 , CVE-2015-8917 ,\nCVE-2015-8922)\n\nMultiple infinite loop / resource exhaustion flaws were found in\nlibarchive. Specially crafted GZIP or ISO files could cause the\napplication to consume an excessive amount of resources, eventually\nleading to a crash on memory exhaustion. (CVE-2016-7166 ,\nCVE-2015-8930)\n\nA denial of service vulnerability was found in libarchive. A specially\ncrafted CPIO archive containing a symbolic link to a large target path\ncould cause memory allocation to fail, causing an application using\nlibarchive that attempted to view or extract such archive to crash.\n(CVE-2016-4809)\n\nAn integer overflow flaw, leading to a buffer overflow, was found in\nlibarchive's construction of ISO9660 volumes. Attempting to create an\nISO9660 volume with 2 GB or 4 GB file names could cause the\napplication to attempt to allocate 20 GB of memory. If this were to\nsucceed, it could lead to an out of bounds write on the heap and\npotential code execution. (CVE-2016-6250)\n\nMultiple instances of undefined behavior due to arithmetic overflow\nwere found in libarchive. Specially crafted MTREE archives, Compress\nstreams, or ISO9660 volumes could potentially cause the application to\nfail to read the archive, or to crash. (CVE-2015-8931 , CVE-2015-8932\n, CVE-2016-5844)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2016-743.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update libarchive' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:bsdcpio\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libarchive-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:libarchive-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"bsdcpio-3.1.2-10.11.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"bsdtar-3.1.2-10.11.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libarchive-3.1.2-10.11.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libarchive-debuginfo-3.1.2-10.11.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"libarchive-devel-3.1.2-10.11.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bsdcpio / bsdtar / libarchive / libarchive-debuginfo / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-02T15:26:25", "description": "From Red Hat Security Advisory 2016:1844 :\n\nAn update for libarchive is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nThe libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es) :\n\n* A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive.\nSpecially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive.\nSpecially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting CVE-2016-5418.", "cvss3": {}, "published": "2016-09-13T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : libarchive (ELSA-2016-1844)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:bsdcpio", "p-cpe:/a:oracle:linux:bsdtar", "p-cpe:/a:oracle:linux:libarchive", "p-cpe:/a:oracle:linux:libarchive-devel", "cpe:/o:oracle:linux:7"], "id": "ORACLELINUX_ELSA-2016-1844.NASL", "href": "https://www.tenable.com/plugins/nessus/93446", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2016:1844 and \n# Oracle Linux Security Advisory ELSA-2016-1844 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(93446);\n script_version(\"2.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8928\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\");\n script_xref(name:\"RHSA\", value:\"2016:1844\");\n\n script_name(english:\"Oracle Linux 7 : libarchive (ELSA-2016-1844)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2016:1844 :\n\nAn update for libarchive is now available for Red Hat Enterprise Linux\n7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe libarchive programming library can create and read several\ndifferent streaming archive formats, including GNU tar, cpio, and ISO\n9660 CD-ROM images. Libarchive is used notably in the bsdtar utility,\nscripting language bindings such as python-libarchive, and several\npopular desktop file managers.\n\nSecurity Fix(es) :\n\n* A flaw was found in the way libarchive handled hardlink archive\nentries of non-zero size. Combined with flaws in libarchive's file\nsystem sandboxing, this issue could cause an application using\nlibarchive to overwrite arbitrary files with arbitrary data from the\narchive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive.\nSpecially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow,\npotentially allowing code execution in the context of the application\nusing libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive.\nSpecially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could\ncause the application to read data out of bounds, potentially\ndisclosing a small amount of application memory, or causing an\napplication crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921,\nCVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926,\nCVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive.\nSpecially crafted RAR, CAB, or 7ZIP files could cause an application\nusing libarchive to crash. (CVE-2015-8916, CVE-2015-8917,\nCVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in\nlibarchive. Specially crafted GZIP or ISO files could cause the\napplication to consume an excessive amount of resources, eventually\nleading to a crash on memory exhaustion. (CVE-2016-7166,\nCVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A\nspecially crafted CPIO archive containing a symbolic link to a large\ntarget path could cause memory allocation to fail, causing an\napplication using libarchive that attempted to view or extract such\narchive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in\nlibarchive's construction of ISO9660 volumes. Attempting to create an\nISO9660 volume with 2 GB or 4 GB file names could cause the\napplication to attempt to allocate 20 GB of memory. If this were to\nsucceed, it could lead to an out of bounds write on the heap and\npotential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow\nwere found in libarchive. Specially crafted MTREE archives, Compress\nstreams, or ISO9660 volumes could potentially cause the application to\nfail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932,\nCVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting\nCVE-2016-5418.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2016-September/006331.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libarchive packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:bsdcpio\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:bsdtar\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libarchive-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2016/05/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/09/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/09/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 7\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\nif (\"x86_64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"bsdcpio-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"bsdtar-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"libarchive-3.1.2-10.el7_2\")) flag++;\nif (rpm_check(release:\"EL7\", cpu:\"x86_64\", reference:\"libarchive-devel-3.1.2-10.el7_2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"bsdcpio / bsdtar / libarchive / libarchive-devel\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-08-19T12:22:51", "description": "According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :\n\n - A vulnerability was found in libarchive. A specially crafted MTREE file could cause a small out-of-bounds read, potentially disclosing a small amount of application memory.(CVE-2015-8925)\n\n - A vulnerability was found in libarchive. An attempt to create an ISO9660 volume with 2GB or 4GB filenames could cause the application to crash.(CVE-2016-6250)\n\n - A vulnerability was found in libarchive. A specially crafted RAR file could cause the application to read memory beyond the end of the decompression buffer.(CVE-2015-8934)\n\n - A vulnerability was found in libarchive's handling of 7zip data. A specially crafted 7zip file can cause a integer overflow resulting in memory corruption that can lead to code execution.(CVE-2016-4300)\n\n - A vulnerability was found in libarchive. A specially crafted 7Z file could trigger a NULL pointer dereference, causing the application to crash.(CVE-2015-8922)\n\n - Undefined behavior (signed integer overflow) was discovered in libarchive, in the ISO parser. A crafted file could potentially cause denial of service.(CVE-2016-5844)\n\n - A vulnerability was found in libarchive. A specially crafted AR archive could cause the application to read a single byte of application memory, potentially disclosing it to the attacker.(CVE-2015-8920)\n\n - A vulnerability was found in libarchive. A specially crafted mtree file could cause libarchive to read beyond a statically declared structure, potentially disclosing application memory.(CVE-2015-8921)\n\n - A vulnerability was found in libarchive. A specially crafted LZA/LZH file could cause a small out-of-bounds read, potentially disclosing a few bytes of application memory.(CVE-2015-8919)\n\n - A vulnerability was found in libarchive. A specially crafted ISO file could cause the application to consume resources until it hit a memory limit, leading to a crash or denial of service.(CVE-2015-8930)\n\n - A vulnerability was found in libarchive. A specially crafted TAR file could trigger an out-of-bounds read, potentially causing the application to disclose a small amount of application memory.(CVE-2015-8924)\n\n - A vulnerability was found in libarchive. A specially crafted MTREE file could cause a limited out-of-bounds read, potentially disclosing contents of application memory.(CVE-2015-8928)\n\n - A vulnerability was found in libarchive. A specially crafted CAB file could cause the application dereference a NULL pointer, leading to a crash.(CVE-2015-8917)\n\n - A vulnerability was found in libarchive. A specially crafted RAR file could cause the application dereference a NULL pointer, leading to a crash.(CVE-2015-8916)\n\n - A vulnerability was found in libarchive's handling of RAR archives. A specially crafted RAR file can cause a heap overflow, potentially leading to code execution in the context of the application.(CVE-2016-4302)\n\n - Undefined behavior (invalid left shift) was discovered in libarchive, in how Compress streams are identified.\n This could cause certain files to be mistakenly identified as Compress archives and fail to read.(CVE-2015-8932)\n\n - A vulnerability was found in libarchive. A specially crafted gzip file can cause libarchive to allocate memory without limit, eventually leading to a crash.(CVE-2016-7166)\n\n - Undefined behavior (signed integer overflow) was discovered in libarchive, in the MTREE parser's calculation of maximum and minimum dates. A crafted mtree file could potentially cause denial of service.(CVE-2015-8931)\n\n - A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive.(CVE-2016-5418)\n\n - Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.(CVE-2013-0211)\n\n - A vulnerability was found in libarchive. A specially crafted zip file can provide an incorrect compressed size, which may allow an attacker to place arbitrary code on the heap and execute it in the context of the application.(CVE-2016-1541)\n\n - A vulnerability was found in libarchive. A specially crafted cpio archive containing a symbolic link to a ridiculously large target path can cause memory allocation to fail, resulting in any attempt to view or extract the archive crashing.(CVE-2016-4809)\n\n - A vulnerability was found in libarchive. A specially crafted ZIP file could cause a few bytes of application memory in a 256-byte region to be disclosed.(CVE-2015-8923)\n\n - A vulnerability was found in libarchive. A specially crafted RAR file could cause the application to disclose a 128k block of memory from an uncontrolled location.(CVE-2015-8926)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2019-05-13T00:00:00", "type": "nessus", "title": "EulerOS Virtualization 3.0.1.0 : libarchive (EulerOS-SA-2019-1470)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-0211", "CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:ibarchive", "cpe:/o:huawei:euleros:uvp:3.0.1.0"], "id": "EULEROS_SA-2019-1470.NASL", "href": "https://www.tenable.com/plugins/nessus/124794", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(124794);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2013-0211\",\n \"CVE-2015-8916\",\n \"CVE-2015-8917\",\n \"CVE-2015-8919\",\n \"CVE-2015-8920\",\n \"CVE-2015-8921\",\n \"CVE-2015-8922\",\n \"CVE-2015-8923\",\n \"CVE-2015-8924\",\n \"CVE-2015-8925\",\n \"CVE-2015-8926\",\n \"CVE-2015-8928\",\n \"CVE-2015-8930\",\n \"CVE-2015-8931\",\n \"CVE-2015-8932\",\n \"CVE-2015-8934\",\n \"CVE-2016-1541\",\n \"CVE-2016-4300\",\n \"CVE-2016-4302\",\n \"CVE-2016-4809\",\n \"CVE-2016-5418\",\n \"CVE-2016-5844\",\n \"CVE-2016-6250\",\n \"CVE-2016-7166\"\n );\n script_bugtraq_id(\n 58926\n );\n\n script_name(english:\"EulerOS Virtualization 3.0.1.0 : libarchive (EulerOS-SA-2019-1470)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing multiple security\nupdates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the libarchive package installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerabilities :\n\n - A vulnerability was found in libarchive. A specially\n crafted MTREE file could cause a small out-of-bounds\n read, potentially disclosing a small amount of\n application memory.(CVE-2015-8925)\n\n - A vulnerability was found in libarchive. An attempt to\n create an ISO9660 volume with 2GB or 4GB filenames\n could cause the application to crash.(CVE-2016-6250)\n\n - A vulnerability was found in libarchive. A specially\n crafted RAR file could cause the application to read\n memory beyond the end of the decompression\n buffer.(CVE-2015-8934)\n\n - A vulnerability was found in libarchive's handling of\n 7zip data. A specially crafted 7zip file can cause a\n integer overflow resulting in memory corruption that\n can lead to code execution.(CVE-2016-4300)\n\n - A vulnerability was found in libarchive. A specially\n crafted 7Z file could trigger a NULL pointer\n dereference, causing the application to\n crash.(CVE-2015-8922)\n\n - Undefined behavior (signed integer overflow) was\n discovered in libarchive, in the ISO parser. A crafted\n file could potentially cause denial of\n service.(CVE-2016-5844)\n\n - A vulnerability was found in libarchive. A specially\n crafted AR archive could cause the application to read\n a single byte of application memory, potentially\n disclosing it to the attacker.(CVE-2015-8920)\n\n - A vulnerability was found in libarchive. A specially\n crafted mtree file could cause libarchive to read\n beyond a statically declared structure, potentially\n disclosing application memory.(CVE-2015-8921)\n\n - A vulnerability was found in libarchive. A specially\n crafted LZA/LZH file could cause a small out-of-bounds\n read, potentially disclosing a few bytes of application\n memory.(CVE-2015-8919)\n\n - A vulnerability was found in libarchive. A specially\n crafted ISO file could cause the application to consume\n resources until it hit a memory limit, leading to a\n crash or denial of service.(CVE-2015-8930)\n\n - A vulnerability was found in libarchive. A specially\n crafted TAR file could trigger an out-of-bounds read,\n potentially causing the application to disclose a small\n amount of application memory.(CVE-2015-8924)\n\n - A vulnerability was found in libarchive. A specially\n crafted MTREE file could cause a limited out-of-bounds\n read, potentially disclosing contents of application\n memory.(CVE-2015-8928)\n\n - A vulnerability was found in libarchive. A specially\n crafted CAB file could cause the application\n dereference a NULL pointer, leading to a\n crash.(CVE-2015-8917)\n\n - A vulnerability was found in libarchive. A specially\n crafted RAR file could cause the application\n dereference a NULL pointer, leading to a\n crash.(CVE-2015-8916)\n\n - A vulnerability was found in libarchive's handling of\n RAR archives. A specially crafted RAR file can cause a\n heap overflow, potentially leading to code execution in\n the context of the application.(CVE-2016-4302)\n\n - Undefined behavior (invalid left shift) was discovered\n in libarchive, in how Compress streams are identified.\n This could cause certain files to be mistakenly\n identified as Compress archives and fail to\n read.(CVE-2015-8932)\n\n - A vulnerability was found in libarchive. A specially\n crafted gzip file can cause libarchive to allocate\n memory without limit, eventually leading to a\n crash.(CVE-2016-7166)\n\n - Undefined behavior (signed integer overflow) was\n discovered in libarchive, in the MTREE parser's\n calculation of maximum and minimum dates. A crafted\n mtree file could potentially cause denial of\n service.(CVE-2015-8931)\n\n - A flaw was found in the way libarchive handled hardlink\n archive entries of non-zero size. Combined with flaws\n in libarchive's file system sandboxing, this issue\n could cause an application using libarchive to\n overwrite arbitrary files with arbitrary data from the\n archive.(CVE-2016-5418)\n\n - Integer signedness error in the archive_write_zip_data\n function in archive_write_set_format_zip.c in\n libarchive 3.1.2 and earlier, when running on 64-bit\n machines, allows context-dependent attackers to cause a\n denial of service (crash) via unspecified vectors,\n which triggers an improper conversion between unsigned\n and signed types, leading to a buffer\n overflow.(CVE-2013-0211)\n\n - A vulnerability was found in libarchive. A specially\n crafted zip file can provide an incorrect compressed\n size, which may allow an attacker to place arbitrary\n code on the heap and execute it in the context of the\n application.(CVE-2016-1541)\n\n - A vulnerability was found in libarchive. A specially\n crafted cpio archive containing a symbolic link to a\n ridiculously large target path can cause memory\n allocation to fail, resulting in any attempt to view or\n extract the archive crashing.(CVE-2016-4809)\n\n - A vulnerability was found in libarchive. A specially\n crafted ZIP file could cause a few bytes of application\n memory in a 256-byte region to be\n disclosed.(CVE-2015-8923)\n\n - A vulnerability was found in libarchive. A specially\n crafted RAR file could cause the application to\n disclose a 128k block of memory from an uncontrolled\n location.(CVE-2015-8926)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1470\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?381a14a8\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libarchive packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/07\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:ibarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:3.0.1.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"3.0.1.0\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 3.0.1.0\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"ibarchive-3.1.2-10.eulerosv2r7\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libarchive\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T15:27:16", "description": "The remote host is affected by the vulnerability described in GLSA-201701-03 (libarchive: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in libarchive. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker could entice a user to open a specially crafted archive file possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2017-01-03T00:00:00", "type": "nessus", "title": "GLSA-201701-03 : libarchive: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-2304", "CVE-2015-8915", "CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8918", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8927", "CVE-2015-8928", "CVE-2015-8929", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8933", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4301", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166", "CVE-2016-8687", "CVE-2016-8688", "CVE-2016-8689"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:libarchive", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201701-03.NASL", "href": "https://www.tenable.com/plugins/nessus/96234", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201701-03.\n#\n# The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(96234);\n script_version(\"3.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-2304\", \"CVE-2015-8915\", \"CVE-2015-8916\", \"CVE-2015-8917\", \"CVE-2015-8918\", \"CVE-2015-8919\", \"CVE-2015-8920\", \"CVE-2015-8921\", \"CVE-2015-8922\", \"CVE-2015-8923\", \"CVE-2015-8924\", \"CVE-2015-8925\", \"CVE-2015-8926\", \"CVE-2015-8927\", \"CVE-2015-8928\", \"CVE-2015-8929\", \"CVE-2015-8930\", \"CVE-2015-8931\", \"CVE-2015-8932\", \"CVE-2015-8933\", \"CVE-2015-8934\", \"CVE-2016-1541\", \"CVE-2016-4300\", \"CVE-2016-4301\", \"CVE-2016-4302\", \"CVE-2016-4809\", \"CVE-2016-5418\", \"CVE-2016-5844\", \"CVE-2016-6250\", \"CVE-2016-7166\", \"CVE-2016-8687\", \"CVE-2016-8688\", \"CVE-2016-8689\");\n script_xref(name:\"GLSA\", value:\"201701-03\");\n\n script_name(english:\"GLSA-201701-03 : libarchive: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201701-03\n(libarchive: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in libarchive. Please\n review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could entice a user to open a specially crafted\n archive file possibly resulting in the execution of arbitrary code with\n the privileges of the process or a Denial of Service condition.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201701-03\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All libarchive users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-arch/libarchive-3.2.2'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:libarchive\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/01/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/01/03\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"app-arch/libarchive\", unaffected:make_list(\"ge 3.2.2\"), vulnerable:make_list(\"lt 3.2.2\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libarchive\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "debiancve": [{"lastseen": "2023-12-02T18:26:25", "description": "Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-07T10:59:00", "type": "debiancve", "title": "CVE-2016-1541", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-07T10:59:00", "id": "DEBIANCVE:CVE-2016-1541", "href": "https://security-tracker.debian.org/tracker/CVE-2016-1541", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2021-10-21T22:15:02", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3574-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nMay 10, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : libarchive\nCVE ID : CVE-2016-1541\nDebian Bug : 823893\n\nRock Stevens, Andrew Ruef and Marcin 'Icewall' Noga discovered a\nheap-based buffer overflow vulnerability in the zip_read_mac_metadata\nfunction in libarchive, a multi-format archive and compression library,\nwhich may lead to the execution of arbitrary code if a user or automated\nsystem is tricked into processing a specially crafted ZIP file.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 3.1.2-11+deb8u1.\n\nWe recommend that you upgrade your libarchive packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-05-10T17:57:06", "type": "debian", "title": "[SECURITY] [DSA 3574-1] libarchive security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-10T17:57:06", "id": "DEBIAN:DSA-3574-1:A80B1", "href": "https://lists.debian.org/debian-security-announce/2016/msg00150.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-03T11:30:21", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3574-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nMay 10, 2016 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : libarchive\nCVE ID : CVE-2016-1541\nDebian Bug : 823893\n\nRock Stevens, Andrew Ruef and Marcin 'Icewall' Noga discovered a\nheap-based buffer overflow vulnerability in the zip_read_mac_metadata\nfunction in libarchive, a multi-format archive and compression library,\nwhich may lead to the execution of arbitrary code if a user or automated\nsystem is tricked into processing a specially crafted ZIP file.\n\nFor the stable distribution (jessie), this problem has been fixed in\nversion 3.1.2-11+deb8u1.\n\nWe recommend that you upgrade your libarchive packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-10T17:57:06", "type": "debian", "title": "[SECURITY] [DSA 3574-1] libarchive security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-10T17:57:06", "id": "DEBIAN:DSA-3574-1:A3F44", "href": "https://lists.debian.org/debian-security-announce/2016/msg00150.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:43", "description": "A vulnerability was found in libarchive. A specially crafted zip file\ncan provide an incorrect compressed size, which may allow an attacker\nto place arbitrary code on the heap and execute it in the context of\nthe application.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2016-07-05T00:00:00", "type": "archlinux", "title": "libarchive: arbitrary code execution", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-07-05T00:00:00", "id": "ASA-201607-1", "href": "https://lists.archlinux.org/pipermail/arch-security/2016-July/000661.html", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "ubuntucve": [{"lastseen": "2023-12-02T15:28:49", "description": "Heap-based buffer overflow in the zip_read_mac_metadata function in\narchive_read_support_format_zip.c in libarchive before 3.2.0 allows remote\nattackers to execute arbitrary code via crafted entry-size values in a ZIP\narchive.\n\n#### Bugs\n\n * <https://github.com/libarchive/libarchive/issues/656>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-07T00:00:00", "type": "ubuntucve", "title": "CVE-2016-1541", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-07T00:00:00", "id": "UB:CVE-2016-1541", "href": "https://ubuntu.com/security/CVE-2016-1541", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "slackware": [{"lastseen": "2023-12-02T15:37:27", "description": "New libarchive packages are available for Slackware 14.1 and -current to\nfix a security issue.\n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n\npatches/packages/libarchive-3.1.2-i486-2_slack14.1.txz: Rebuilt.\n Patched an issue with Zip archive handling that could allow an attacker\n to overwrite parts of the heap in a controlled fashion and execute\n arbitrary code.\n For more information, see:\n https://vulners.com/cve/CVE-2016-1541\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libarchive-3.1.2-i486-2_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libarchive-3.1.2-x86_64-2_slack14.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libarchive-3.1.2-i586-3.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/libarchive-3.1.2-x86_64-3.txz\n\n\nMD5 signatures:\n\nSlackware 14.1 package:\n36d7ea07c94eb19c7bddbb6b14085995 libarchive-3.1.2-i486-2_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n23098669ee8382889d926ef24ec00d91 libarchive-3.1.2-x86_64-2_slack14.1.txz\n\nSlackware -current package:\n0e1ce376d5fd570371e5ab98c9134d42 l/libarchive-3.1.2-i586-3.txz\n\nSlackware x86_64 -current package:\n666d5136d4648aba95a55920fb9411fe l/libarchive-3.1.2-x86_64-3.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg libarchive-3.1.2-i486-2_slack14.1.txz", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-25T05:53:14", "type": "slackware", "title": "[slackware-security] libarchive", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-25T05:53:14", "id": "SSA-2016-145-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.352685", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cert": [{"lastseen": "2023-12-02T17:30:58", "description": "### Overview\n\nAn attacker may be able to coerce a user into executing arbitrary code in the context of the current user by attempting to unzip a crafted zip file provided by the attacker.\n\n### Description\n\n[**CWE-20**](<http://cwe.mitre.org/data/definitions/20.html>)**: Improper Input Validation - **CVE-2016-1541\n\nA crafted zip file can provide an incorrect compressed size, which may allow an attacker to place arbitrary code on the heap and execute it in the context of the current user. The user must be coerced into unzipping the crafted zip file. \n \nThe researcher has confirmed that version 3.1.2 is impacted. Previous versions may also be affected. \n \n--- \n \n### Impact\n\nAn attacker may be able coerce a user into unzipping a file that executes arbitrary code in the context of the current user. \n \n--- \n \n### Solution\n\n**Apply an update** \n \nlibarchive has released [version 3.2.0](<http://www.libarchive.org/>) which addresses this problem. Affected users should update as soon as possible. \n \n--- \n \n### Vendor Information\n\n862384\n\nFilter by status: All Affected Not Affected Unknown\n\nFilter by content: __ Additional information available\n\n__ Sort by: Status Alphabetical\n\nExpand all\n\n**Javascript is disabled. Click here to view vendors.**\n\n### libarchive Affected\n\nNotified: February 22, 2016 Updated: May 02, 2016 \n\n**Statement Date: April 30, 2016**\n\n### Status\n\nAffected\n\n### Vendor Statement\n\nWe have not received a statement from the vendor.\n\n### Vendor Information \n\nWe are not aware of further vendor information regarding this vulnerability.\n\n \n\n\n### CVSS Metrics\n\nGroup | Score | Vector \n---|---|--- \nBase | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P \nTemporal | 6.1 | E:POC/RL:U/RC:C \nEnvironmental | 4.6 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND \n \n \n\n\n### References\n\n * <https://github.com/libarchive/libarchive/issues/656>\n * <http://www.libarchive.org/>\n\n### Acknowledgements\n\nThanks to Rock Stevens and Andrew Ruef for reporting this vulnerability.\n\nThis document was written by Garret Wassermann.\n\n### Other Information\n\n**CVE IDs:** | [CVE-2016-1541](<http://web.nvd.nist.gov/vuln/detail/CVE-2016-1541>) \n---|--- \n**Date Public:** | 2016-05-01 \n**Date First Published:** | 2016-05-02 \n**Date Last Updated: ** | 2016-05-04 18:58 UTC \n**Document Revision: ** | 40 \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-02T00:00:00", "type": "cert", "title": "libarchive contains a heap-based buffer overflow due to improper input validation", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-04T18:58:00", "id": "VU:862384", "href": "https://www.kb.cert.org/vuls/id/862384", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "seebug": [{"lastseen": "2017-11-19T13:10:54", "description": "### SUMMARY\r\nAn exploitable heap overflow vulnerability exists in the zip archive decompression functionality of libarchive. A specially crafted zip file can cause memory corruption leading to code execution. An attacker can send a malformed file to trigger this vulnerability.\r\n\r\n### TESTED VERSIONS\r\nlibarchive 3.1.2\r\n\r\n### PRODUCT URLS\r\nhttps://github.com/libarchive/libarchive\r\n\r\n### CVSSv3 SCORE\r\n7.8 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\r\n\r\n### DETAILS\r\nVulnerable code exists in zip support format module:\r\n```\r\nlibarchive\\archive_read_support_format_zip.c:\r\nLine 2716 static int\r\nLine 2717 zip_read_mac_metadata(struct archive_read *a, struct archive_entry *entry,\r\nLine 2718 struct zip_entry *rsrc)\r\nLine 2719 {\r\n(...)\r\nLine 2750 metadata = malloc((size_t)rsrc->uncompressed_size); // <--- NULL ALLOCATION\r\nLine 2751 if (metadata == NULL) {\r\nLine 2752 archive_set_error(&a->archive, ENOMEM,\r\nLine 2753 \"Can't allocate memory for Mac metadata\");\r\nLine 2754 return (ARCHIVE_FATAL);\r\nLine 2755 }\r\n(...)\r\nLine 2766 remaining_bytes = (size_t)rsrc->compressed_size;\r\nLine 2767 metadata_bytes = (size_t)rsrc->uncompressed_size;\r\nLine 2768 mp = metadata;\r\nLine 2769 eof = 0;\r\nLine 2770 while (!eof && remaining_bytes) {\r\nLine 2771 const unsigned char *p;\r\nLine 2772 ssize_t bytes_avail;\r\nLine 2773 size_t bytes_used;\r\nLine 2774\r\nLine 2775 p = __archive_read_ahead(a, 1, &bytes_avail);\r\nLine 2776 if (p == NULL) {\r\nLine 2777 archive_set_error(&a->archive,\r\nLine 2778 ARCHIVE_ERRNO_FILE_FORMAT,\r\nLine 2779 \"Truncated ZIP file header\");\r\nLine 2780 ret = ARCHIVE_WARN;\r\nLine 2781 goto exit_mac_metadata;\r\nLine 2782 }\r\nLine 2783 if ((size_t)bytes_avail > remaining_bytes)\r\nLine 2784 bytes_avail = remaining_bytes;\r\nLine 2785 switch(rsrc->compression) {\r\nLine 2786 case 0: /* No compression. */\r\nLine 2787 memcpy(mp, p, bytes_avail); // <-- BUFFER OVERFLOW\r\n```\r\n\r\nZip file created on Mac OSX can contain also special directory/files called resource fork : https://en.wikipedia.org/wiki/Resource_fork. In line 2750 we see that based on \"uncompressed_size\" field of resource entry is used for allocation of the \"metadata\" buffer. This value is not checked, so a zero sized buffer may be allocated.\r\n\r\nLater on line 2787, the user controlled \"compressed_size\" field is copied into \"mp\" (\"metadata\") buffer. Depending on malloc implementation and heap state, malloc for size 0 will succeed and memory can be written outside the bounds of the undersized buffer. Attacker in this scenario can fully control amount and content of bytes used to overwrite.\r\n\r\n### CRASH INFORMATION\r\n```\r\nValgrind Analysis:\r\n==59137== Memcheck, a memory error detector\r\n==59137== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\r\n==59137== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info\r\n==59137== \r\n==59137== Invalid write of size 2\r\n==59137== at 0x402EED3: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\r\n==59137== by 0x8080AE1: zip_read_mac_metadata (archive_read_support_format_zip.c:2795)\r\n==59137== by 0x8080F1F: archive_read_format_zip_seekable_read_header (archive_read_support_format_zip.c:2930)\r\n==59137== by 0x804E3C6: _archive_read_next_header2 (archive_read.c:645)\r\n==59137== by 0x804E47A: _archive_read_next_header (archive_read.c:683)\r\n==59137== by 0x8088A13: archive_read_next_header (archive_virtual.c:148)\r\n==59137== by 0x804A178: extract (ext.c:55)\r\n==59137== by 0x804A271: main (ext.c:83)\r\n==59137== Address 0x4459ae0 is 0 bytes after a block of size 0 alloc'd\r\n==59137== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\r\n==59137== by 0x808095C: zip_read_mac_metadata (archive_read_support_format_zip.c:2758)\r\n==59137== by 0x8080F1F: archive_read_format_zip_seekable_read_header (archive_read_support_format_zip.c:2930)\r\n==59137== by 0x804E3C6: _archive_read_next_header2 (archive_read.c:645)\r\n==59137== by 0x804E47A: _archive_read_next_header (archive_read.c:683)\r\n==59137== by 0x8088A13: archive_read_next_header (archive_virtual.c:148)\r\n==59137== by 0x804A178: extract (ext.c:55)\r\n==59137== by 0x804A271: main (ext.c:83)\r\n==59137== \r\n==59137== Invalid write of size 1\r\n==59137== at 0x402F04B: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\r\n==59137== by 0x8080AE1: zip_read_mac_metadata (archive_read_support_format_zip.c:2795)\r\n==59137== by 0x8080F1F: archive_read_format_zip_seekable_read_header (archive_read_support_format_zip.c:2930)\r\n==59137== by 0x804E3C6: _archive_read_next_header2 (archive_read.c:645)\r\n==59137== by 0x804E47A: _archive_read_next_header (archive_read.c:683)\r\n==59137== by 0x8088A13: archive_read_next_header (archive_virtual.c:148)\r\n==59137== by 0x804A178: extract (ext.c:55)\r\n==59137== by 0x804A271: main (ext.c:83)\r\n==59137== Address 0x4459b92 is not stack'd, malloc'd or (recently) free'd\r\n```\r\n\r\n### TIMELINE\r\n* 2016-04-19 - Vendor Disclosure \r\n* 2016-05-01 - Public Release", "cvss3": {}, "published": "2017-10-26T00:00:00", "type": "seebug", "title": "Libarchive zip zip_read_mac_metadata Code Execution Vulnerability(CVE-2016-1541)", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2016-1541"], "modified": "2017-10-26T00:00:00", "id": "SSV:96783", "href": "https://www.seebug.org/vuldb/ssvid-96783", "sourceData": "", "sourceHref": "", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "ubuntu": [{"lastseen": "2023-12-02T17:23:33", "description": "## Releases\n\n * Ubuntu 16.04 ESM\n * Ubuntu 15.10 \n * Ubuntu 14.04 ESM\n * Ubuntu 12.04 \n\n## Packages\n\n * libarchive \\- Library to read/write archive files\n\nIt was discovered that libarchive incorrectly handled certain entry-size \nvalues in ZIP archives. A remote attacker could use this issue to cause \nlibarchive to crash, resulting in a denial of service, or possibly execute \narbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 \nand Ubuntu 16.04 LTS. (CVE-2016-1541)\n\nIt was discovered that libarchive incorrectly handled memory when \nprocessing certain tar files. A remote attacker could use this issue to \ncause libarchive to crash, resulting in a denial of service. (CVE number \npending)\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-17T00:00:00", "type": "ubuntu", "title": "libarchive vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-17T00:00:00", "id": "USN-2981-1", "href": "https://ubuntu.com/security/notices/USN-2981-1", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "talos": [{"lastseen": "2023-12-02T16:55:37", "description": "### SUMMARY\n\nAn exploitable heap overflow vulnerability exists in the zip archive decompression functionality of libarchive. A specially crafted zip file can cause memory corruption leading to code execution. An attacker can send a malformed file to trigger this vulnerability.\n\n### TESTED VERSIONS\n\nlibarchive 3.1.2\n\n### PRODUCT URLS\n\nhttps://github.com/libarchive/libarchive\n\n### CVSSv3 SCORE\n \n \n 7.8 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n CVSSv3 Calculator: https://www.first.org/cvss/calculator/3.0\n \n\n### DETAILS\n\nVulnerable code exists in zip support format module:\n \n \n libarchive\\archive_read_support_format_zip.c:\n Line 2716\tstatic int\n Line 2717\tzip_read_mac_metadata(struct archive_read *a, struct archive_entry *entry,\n Line 2718\t\tstruct zip_entry *rsrc)\n Line 2719\t{\n (...)\n Line 2750\tmetadata = malloc((size_t)rsrc->uncompressed_size); // <--- NULL ALLOCATION\n Line 2751\tif (metadata == NULL) {\n Line 2752\t\tarchive_set_error(&a->archive, ENOMEM,\n Line 2753\t\t \"Can't allocate memory for Mac metadata\");\n Line 2754\t\treturn (ARCHIVE_FATAL);\n Line 2755\t}\n (...)\n Line 2766\tremaining_bytes = (size_t)rsrc->compressed_size;\n Line 2767\tmetadata_bytes = (size_t)rsrc->uncompressed_size;\n Line 2768\tmp = metadata;\n Line 2769\teof = 0;\n Line 2770\twhile (!eof && remaining_bytes) {\n Line 2771\t\tconst unsigned char *p;\n Line 2772\t\tssize_t bytes_avail;\n Line 2773\t\tsize_t bytes_used;\n Line 2774\n Line 2775\t\tp = __archive_read_ahead(a, 1, &bytes_avail);\n Line 2776\t\tif (p == NULL) {\n Line 2777\t\t\tarchive_set_error(&a->archive,\n Line 2778\t\t\t ARCHIVE_ERRNO_FILE_FORMAT,\n Line 2779\t\t\t \"Truncated ZIP file header\");\n Line 2780\t\t\tret = ARCHIVE_WARN;\n Line 2781\t\t\tgoto exit_mac_metadata;\n Line 2782\t\t}\n Line 2783\t\tif ((size_t)bytes_avail > remaining_bytes)\n Line 2784\t\t\tbytes_avail = remaining_bytes;\n Line 2785\t\tswitch(rsrc->compression) {\n Line 2786\t\tcase 0: /* No compression. */\n Line 2787\t\t\tmemcpy(mp, p, bytes_avail);\t\t\t\t\t// <-- BUFFER OVERFLOW\n \n\nZip file created on Mac OSX can contain also special directory/files called resource fork : https://en.wikipedia.org/wiki/Resource_fork. In line 2750 we see that based on \u201cuncompressed_size\u201d field of resource entry is used for allocation of the \u201cmetadata\u201d buffer. This value is not checked, so a zero sized buffer may be allocated.\n\nLater on line 2787, the user controlled \u201ccompressed_size\u201d field is copied into \u201cmp\u201d (\u201cmetadata\u201d) buffer. Depending on malloc implementation and heap state, malloc for size 0 will succeed and memory can be written outside the bounds of the undersized buffer. Attacker in this scenario can fully control amount and content of bytes used to overwrite.\n\n### CRASH INFORMATION\n \n \n Valgrind Analysis:\n ==59137== Memcheck, a memory error detector\n ==59137== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\n ==59137== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info\n ==59137== \n ==59137== Invalid write of size 2\n ==59137== at 0x402EED3: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\n ==59137== by 0x8080AE1: zip_read_mac_metadata (archive_read_support_format_zip.c:2795)\n ==59137== by 0x8080F1F: archive_read_format_zip_seekable_read_header (archive_read_support_format_zip.c:2930)\n ==59137== by 0x804E3C6: _archive_read_next_header2 (archive_read.c:645)\n ==59137== by 0x804E47A: _archive_read_next_header (archive_read.c:683)\n ==59137== by 0x8088A13: archive_read_next_header (archive_virtual.c:148)\n ==59137== by 0x804A178: extract (ext.c:55)\n ==59137== by 0x804A271: main (ext.c:83)\n ==59137== Address 0x4459ae0 is 0 bytes after a block of size 0 alloc'd\n ==59137== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\n ==59137== by 0x808095C: zip_read_mac_metadata (archive_read_support_format_zip.c:2758)\n ==59137== by 0x8080F1F: archive_read_format_zip_seekable_read_header (archive_read_support_format_zip.c:2930)\n ==59137== by 0x804E3C6: _archive_read_next_header2 (archive_read.c:645)\n ==59137== by 0x804E47A: _archive_read_next_header (archive_read.c:683)\n ==59137== by 0x8088A13: archive_read_next_header (archive_virtual.c:148)\n ==59137== by 0x804A178: extract (ext.c:55)\n ==59137== by 0x804A271: main (ext.c:83)\n ==59137== \n ==59137== Invalid write of size 1\n ==59137== at 0x402F04B: memcpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\n ==59137== by 0x8080AE1: zip_read_mac_metadata (archive_read_support_format_zip.c:2795)\n ==59137== by 0x8080F1F: archive_read_format_zip_seekable_read_header (archive_read_support_format_zip.c:2930)\n ==59137== by 0x804E3C6: _archive_read_next_header2 (archive_read.c:645)\n ==59137== by 0x804E47A: _archive_read_next_header (archive_read.c:683)\n ==59137== by 0x8088A13: archive_read_next_header (archive_virtual.c:148)\n ==59137== by 0x804A178: extract (ext.c:55)\n ==59137== by 0x804A271: main (ext.c:83)\n ==59137== Address 0x4459b92 is not stack'd, malloc'd or (recently) free'd\n \n\n### TIMELINE\n\n2016-04-19 - Vendor Disclosure \n2016-05-01 - Public Release \n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-05-01T00:00:00", "type": "talos", "title": "Libarchive zip zip_read_mac_metadata Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-05-01T00:00:00", "id": "TALOS-2016-0155", "href": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0155", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cloudfoundry": [{"lastseen": "2023-12-02T16:14:12", "description": "USN-2981-1 libarchive vulnerabilities\n\n# \n\nMedium\n\n# Vendor\n\nLibarchive, Canonical Ubuntu\n\n# Versions Affected\n\nUbuntu 14.04 LTS\n\n# Description\n\nIt was discovered that libarchive incorrectly handled certain entry-size values in ZIP archives. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. ([CVE-2016-1541](<http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1541.html>))\n\n# Affected Products and Versions\n\n_Severity is medium unless otherwise noted. \n_\n\n * All versions of Cloud Foundry cflinuxfs2 prior to v.1.58.0 \n\n# Mitigation\n\nUsers of affected versions should apply the following mitigation:\n\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 v.1.58.0 or later versions \n\n# References\n\n * <http://www.ubuntu.com/usn/usn-2981-1/>\n * <http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1541.html>\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-06-13T00:00:00", "type": "cloudfoundry", "title": "USN-2981-1 libarchive vulnerabilities | Cloud Foundry", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2016-1541"], "modified": "2016-06-13T00:00:00", "id": "CFOUNDRY:61AB171811D246E9A2549531C4BC3E22", "href": "https://www.cloudfoundry.org/blog/usn-2981-1/", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ibm": [{"lastseen": "2023-02-21T05:46:54", "description": "## Summary\n\nMultiple libarchive vulnerabilities affect Watson Explorer.\n\n## Vulnerability Details\n\n**CVEID:** [_CVE-2015-8915_](<https://vulners.com/cve/CVE-2015-8915%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an invalid memory read in CPIO parser. By reading a specially-crafted CPIO file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 5.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114249_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114249>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2015-8923_](<https://vulners.com/cve/CVE-2015-8923%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an error in the ZIP parser. A remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 5.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114257_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114257>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\n \n \n**CVEID:** [_CVE-2015-8924_](<https://vulners.com/cve/CVE-2015-8924%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a heap-based buffer overflow, caused by an out of bounds read error in TAR parser. By persuading a victim to open a specially-crafted TAR file, a remote attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 6.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114258_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114258>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) \n \n**CVEID:** [_CVE-2015-8920_](<https://vulners.com/cve/CVE-2015-8920%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a stack-based buffer overflow, caused by an out of bounds read error in ar parser. By persuading a victim to open a specially-crafted ar file, a remote attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 6.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114254_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114254>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) \n \n**CVEID:** [_CVE-2015-8929_](<https://vulners.com/cve/CVE-2015-8929%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an error in __archive_read_get_extract in TAR parser. An remote attacker could exploit this vulnerability to cause a memory leak resulting in a denial of service. \nCVSS Base Score: 5.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114264_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114264>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n**CVEID:** [_CVE-2015-8930_](<https://vulners.com/cve/CVE-2015-8930%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an error in ISO parser. A remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop. \nCVSS Base Score: 5.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114265_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114265>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n**CVEID:** [_CVE-2015-8927_](<https://vulners.com/cve/CVE-2015-8927%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a heap-based buffer overflow, caused by an out of bounds read error in trad_enc_decrypt_update() function. By reading password for a specially-crafted ZIP file, a remote attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 7.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114261_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114261>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) \n \n**CVEID:** [_CVE-2015-8932_](<https://vulners.com/cve/CVE-2015-8932%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an shiftleft error in compress_bidder_init in TAR parser. A remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 5.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114267_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114267>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) \n \n**CVEID:** [_CVE-2015-8933_](<https://vulners.com/cve/CVE-2015-8933%5C>) \n**DESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in archive_read_format_tar_skip() in TAR parser. An attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 7.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114268_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114268>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) \n \n**CVEID:** [_CVE-2016-1541_](<https://vulners.com/cve/CVE-2016-1541%5C>) \n**DESCRIPTION:** libarchive is vulnerable to a heap-based buffer overflow. By persuading a victim to unzip a specially-crafted zip file, a remote attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 6.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/112828_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/112828>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) \n\n## Affected Products and Versions\n\nThis vulnerability applies to the following products and versions: \n\n * Watson Explorer Foundational Components versions 11.0.0.0 - 11.0.1\n * Watson Explorer Foundational Components versions 10.0.0.0 - 10.0.0.2\n\n## Remediation/Fixes\n\nFollow these steps to upgrade to the required version of libarchive. \nThe table reflects product names at the time the specified versions were released. To use the link to Fix Central in this table, you must first log in to the IBM Support: Fix Central site at <http://www.ibm.com/support/fixcentral/>. \n \n\n\n**Affected Product**| **Affected Versions**| **Fix** \n---|---|--- \nWatson Explorer Foundational Components| 11.0.0.0 - 11.0.1| Upgrade to Version 11.0.1 (if necessary), then apply the 11.0.1 interim fix. \n\n\n 1. If not already installed, upgrade to version 11.0.1. See[ Upgrading to Watson Explorer Foundational Components Version 11.0.1](<http://www.ibm.com/support/docview.wss?uid=swg27047699>) for upgrade instructions and [Watson Explorer 11.0.1 Foundational Components](<http://www-01.ibm.com/support/docview.wss?uid=swg24041946>) for download information and instructions. \n 2. Download the 11.0.1 interim fix for your edition of Watson Explorer from [Fix Central](<http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Watson%2BGroup&product=ibm/Information+Management/InfoSphere+Data+Explorer&release=11.0.1.0&platform=All&function=all#Watson%20Explorer>).\n 3. Place the interim fix zip or tar file at the root of the Watson Explorer Engine installation directory. \nDefault locations: \nLinux: `/opt/ibm/WEX/Engine`` ` \nWindows: `\\Program Files\\IBM\\WEX\\Engine`\n 4. Run `Engine/bin/velocity-shutdown[.exe]`\n 5. Extract all files from the archive file. Agree to all overwrites. \n 6. Linux users should change ownership on all Engine subdirectories to their Apache user and Apache user group by running `chown -R apache:apache *`\n 7. Run `Engine/bin/velocity-startup[.exe]` \nWatson Explorer Foundational Components| 10.0.0.0 - 10.0.0.2| Upgrade to Version 10.0.0.3 \n \nSee [Watson Explorer Version 10.0.0.3 Foundational Components](<http://www.ibm.com/support/docview.wss?uid=swg24042586>) for download information and instructions. \n \nNote: For SUSE Linux 11 contact [IBM Support](<https://www.ibm.com/support/entry/portal/product/watson_group/watson_explorer>) for more information. \n \n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-06-17T13:07:18", "type": "ibm", "title": "Security Bulletin: Multiple libarchive vulnerabilities affect Watson Explorer", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8915", "CVE-2015-8920", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8927", "CVE-2015-8929", "CVE-2015-8930", "CVE-2015-8932", "CVE-2015-8933", "CVE-2016-1541"], "modified": "2018-06-17T13:07:18", "id": "A7530D3911C124CC1D017D2F76443EE51CEF5BAC2117B0B8B20612AAEAEA2914", "href": "https://www.ibm.com/support/pages/node/548647", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-21T21:52:46", "description": "## Summary\n\nPowerKVM is affected by numerous vulnerabilities in libarchive. IBM has now addressed these vulnerabilities.\n\n## Vulnerability Details\n\n**CVEID:** [_CVE-2015-8916_](<https://vulners.com/cve/CVE-2015-8916>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer dereference error in RAR parser. By persuading a victim to open a specially crafted RAR file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114250_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114250>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) \n\n**CVEID:** [_CVE-2015-8917_](<https://vulners.com/cve/CVE-2015-8917>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer dereference error in CAB parser. By persuading a victim to open a specially crafted CAB file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114251_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114251>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2015-8919_](<https://vulners.com/cve/CVE-2015-8919>)** \nDESCRIPTION:** libarchive is vulnerable to a heap-based buffer overflow, caused by an out of bounds read error in LHA/LZH parser. By persuading a victim to open a specially-crafted LHA/LZH file, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 5.5 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114253_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114253>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2015-8920_](<https://vulners.com/cve/CVE-2015-8920>)** \nDESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds read error in AR parser. By persuading a victim to open a specially-crafted AR file, a remote attacker could exploit this vulnerability to read a single byte of application memory. \nCVSS Base Score: 3.5 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114254_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114254>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)\n\n**CVEID:** [_CVE-2015-8921_](<https://vulners.com/cve/CVE-2015-8921>)** \nDESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds read error in mtree parser. By persuading a victim to open a specially-crafted mtree file, a remote attacker could exploit this vulnerability to read beyond a statically declared structure. \nCVSS Base Score: 3.5 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114255_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114255>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)\n\n**CVEID:** [_CVE-2015-8922_](<https://vulners.com/cve/CVE-2015-8922>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer dereference error. By persuading a victim to open a specially crafted 7Z file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114256_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114256>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2015-8928_](<https://vulners.com/cve/CVE-2015-8928>)** \nDESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds read error in process_add_entry() function. By persuading a victim to open a specially-crafted mtree file, a remote attacker could exploit this vulnerability to obtain sensitive information. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114262_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114262>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)\n\n**CVEID:** [_CVE-2015-8923_](<https://vulners.com/cve/CVE-2015-8923>)** \nDESCRIPTION:** libarchive could allow a remote attacker to obtain sensitive information, caused by an error in the ZIP parser. By persuading a victim to open a specially crafted ZIP file, a remote attacker could exploit this vulnerability to obtain sensitive information. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114257_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114257>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)\n\n**CVEID:** [_CVE-2015-8924_](<https://vulners.com/cve/CVE-2015-8924>)** \nDESCRIPTION:** libarchive could allow a remote attacker to obtain sensitive information, caused by an error in the TAR parser. By persuading a victim to open a specially crafted TAR file, a remote attacker could exploit this vulnerability to obtain sensitive information. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114258_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114258>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)\n\n**CVEID:** [_CVE-2015-8925_](<https://vulners.com/cve/CVE-2015-8925>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an invalid memory read in read_mtree function. By reading a specially-crafted mtree file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 5.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114259_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114259>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2015-8926_](<https://vulners.com/cve/CVE-2015-8926>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer access error in RAR parser. By persuading a victim to open a specially crafted RAR file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114260_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114260>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2015-8930_](<https://vulners.com/cve/CVE-2015-8930>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an error in ISO parser. By persuading a victim to open a specially crafted ISO file, a remote attacker could exploit this vulnerability to consume all available resources. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114265_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114265>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2015-8931_](<https://vulners.com/cve/CVE-2015-8931>)** \nDESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in archive_read_support_format_mtree.c in mtree parser. By sending a specially-crafted mtree file, an attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 7.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114266_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114266>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2015-8932_](<https://vulners.com/cve/CVE-2015-8932>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an shiftleft error in compress_bidder_init in TAR parser. By persuading a victim to open a specially crafted TAR file, a remote attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 4.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114267_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114267>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2016-1541_](<https://vulners.com/cve/CVE-2016-1541>)** \nDESCRIPTION:** libarchive is vulnerable to a heap-based buffer overflow. By persuading a victim to unzip a specially-crafted zip file, a remote attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 6.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/112828_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/112828>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2016-4300_](<https://vulners.com/cve/CVE-2016-4300>)** \nDESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the 7zip read_SubStreamsInfo. By sending a specially-crafted 7zip file, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base Score: 7.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114247_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114247>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2015-8934_](<https://vulners.com/cve/CVE-2015-8934>)** \nDESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds heap read error in RAR parser. By persuading a victim to open a specially-crafted RAR file, a remote attacker could exploit this vulnerability to read memory beyond the end of the decompression buffer. \nCVSS Base Score: 3.5 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114270_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114270>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)\n\n**CVEID:** [_CVE-2016-6250_](<https://vulners.com/cve/CVE-2016-6250>)** \nDESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the isoent_gen_joliet_identifier() function. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base Score: 7.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/115376_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/115376>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2016-4302_](<https://vulners.com/cve/CVE-2016-4302>)** \nDESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by a heap overflow in the Rar RestartModel. By sending a specially-crafted Rar file, an attacker could exploit this vulnerability to execute arbitrary code on the system. \nCVSS Base Score: 7.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114245_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114245>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2016-4809_](<https://vulners.com/cve/CVE-2016-4809>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service. By persuading a victim to open a specially crafted cpio archive containing a symbolic link, a remote authenticated attacker could exploit this vulnerability to cause the application to crash. \nCVSS Base Score: 3.5 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/116906_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/116906>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)\n\n**CVEID:** [_CVE-2016-5418_](<https://vulners.com/cve/CVE-2016-5418>)** \nDESCRIPTION:** libarchive could allow a remote authenticated attacker to overwrite arbitrary files, caused by the improper handling of hardlink archive entries of non-zero size. An attacker could exploit this vulnerability to overwrite arbitrary files with arbitrary data from the archive. \nCVSS Base Score: 5 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/116907_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/116907>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2016-5844_](<https://vulners.com/cve/CVE-2016-5844>)** \nDESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in choose_volume(). By persuading a victim to open a specially-crafted ISO file, an attacker could overflow a buffer and execute arbitrary code on the system. \nCVSS Base Score: 6.3 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/114496_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/114496>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)\n\n**CVEID:** [_CVE-2016-7166_](<https://vulners.com/cve/CVE-2016-7166>)** \nDESCRIPTION:** libarchive is vulnerable to a denial of service. By persuading a victim to open a specially crafted gzip file, a remote authenticated attacker could exploit this vulnerability to allocate memory without limit and cause the application to crash. \nCVSS Base Score: 3.5 \nCVSS Temporal Score: See [_https://exchange.xforce.ibmcloud.com/vulnerabilities/116908_](<https://exchange.xforce.ibmcloud.com/vulnerabilities/116908>) for the current score \nCVSS Environmental Score*: Undefined \nCVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)\n\n## Affected Products and Versions\n\nPowerKVM 3.1 only\n\n## Remediation/Fixes\n\nustomers can update PowerKVM systems by using \"yum update\". \n\nFix images are made available via Fix Central. For version 3.1, see [_https://ibm.biz/BdHggw_](<https://ibm.biz/BdHggw>). This issue is addressed as of 3.1.0.2 update 3 or later.\n\n## Workarounds and Mitigations\n\nNone\n\n## ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2018-06-18T01:33:29", "type": "ibm", "title": "Security Bulletin: Vulnerabilities in libarchive affect PowerKVM", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2018-06-18T01:33:29", "id": "B8F10A57EB3F53A53A4A19FCEC4D50915E4C3835263C5F55B74321D2C2634DF2", "href": "https://www.ibm.com/support/pages/node/629747", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "amazon": [{"lastseen": "2023-12-03T18:08:14", "description": "**Issue Overview:**\n\nA flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\nMultiple out-of-bounds write flaws were found in libarchive. Specially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\nMultiple out-of-bounds read flaws were found in libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\nMultiple NULL pointer dereference flaws were found in libarchive. Specially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\nMultiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\nA denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\nAn integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\nMultiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844) \n\n\n \n**Affected Packages:** \n\n\nlibarchive\n\n \n**Issue Correction:** \nRun _yum update libarchive_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n \u00a0\u00a0\u00a0 libarchive-devel-3.1.2-10.11.amzn1.i686 \n \u00a0\u00a0\u00a0 bsdtar-3.1.2-10.11.amzn1.i686 \n \u00a0\u00a0\u00a0 libarchive-3.1.2-10.11.amzn1.i686 \n \u00a0\u00a0\u00a0 bsdcpio-3.1.2-10.11.amzn1.i686 \n \u00a0\u00a0\u00a0 libarchive-debuginfo-3.1.2-10.11.amzn1.i686 \n \n src: \n \u00a0\u00a0\u00a0 libarchive-3.1.2-10.11.amzn1.src \n \n x86_64: \n \u00a0\u00a0\u00a0 bsdtar-3.1.2-10.11.amzn1.x86_64 \n \u00a0\u00a0\u00a0 libarchive-devel-3.1.2-10.11.amzn1.x86_64 \n \u00a0\u00a0\u00a0 libarchive-3.1.2-10.11.amzn1.x86_64 \n \u00a0\u00a0\u00a0 bsdcpio-3.1.2-10.11.amzn1.x86_64 \n \u00a0\u00a0\u00a0 libarchive-debuginfo-3.1.2-10.11.amzn1.x86_64 \n \n \n\n### Additional References\n\nRed Hat: [CVE-2015-8916](<https://access.redhat.com/security/cve/CVE-2015-8916>), [CVE-2015-8917](<https://access.redhat.com/security/cve/CVE-2015-8917>), [CVE-2015-8919](<https://access.redhat.com/security/cve/CVE-2015-8919>), [CVE-2015-8920](<https://access.redhat.com/security/cve/CVE-2015-8920>), [CVE-2015-8921](<https://access.redhat.com/security/cve/CVE-2015-8921>), [CVE-2015-8922](<https://access.redhat.com/security/cve/CVE-2015-8922>), [CVE-2015-8923](<https://access.redhat.com/security/cve/CVE-2015-8923>), [CVE-2015-8924](<https://access.redhat.com/security/cve/CVE-2015-8924>), [CVE-2015-8925](<https://access.redhat.com/security/cve/CVE-2015-8925>), [CVE-2015-8926](<https://access.redhat.com/security/cve/CVE-2015-8926>), [CVE-2015-8928](<https://access.redhat.com/security/cve/CVE-2015-8928>), [CVE-2015-8930](<https://access.redhat.com/security/cve/CVE-2015-8930>), [CVE-2015-8931](<https://access.redhat.com/security/cve/CVE-2015-8931>), [CVE-2015-8932](<https://access.redhat.com/security/cve/CVE-2015-8932>), [CVE-2015-8934](<https://access.redhat.com/security/cve/CVE-2015-8934>), [CVE-2016-1541](<https://access.redhat.com/security/cve/CVE-2016-1541>), [CVE-2016-4300](<https://access.redhat.com/security/cve/CVE-2016-4300>), [CVE-2016-4302](<https://access.redhat.com/security/cve/CVE-2016-4302>), [CVE-2016-4809](<https://access.redhat.com/security/cve/CVE-2016-4809>), [CVE-2016-5418](<https://access.redhat.com/security/cve/CVE-2016-5418>), [CVE-2016-5844](<https://access.redhat.com/security/cve/CVE-2016-5844>), [CVE-2016-6250](<https://access.redhat.com/security/cve/CVE-2016-6250>), [CVE-2016-7166](<https://access.redhat.com/security/cve/CVE-2016-7166>)\n\nMitre: [CVE-2015-8916](<https://vulners.com/cve/CVE-2015-8916>), [CVE-2015-8917](<https://vulners.com/cve/CVE-2015-8917>), [CVE-2015-8919](<https://vulners.com/cve/CVE-2015-8919>), [CVE-2015-8920](<https://vulners.com/cve/CVE-2015-8920>), [CVE-2015-8921](<https://vulners.com/cve/CVE-2015-8921>), [CVE-2015-8922](<https://vulners.com/cve/CVE-2015-8922>), [CVE-2015-8923](<https://vulners.com/cve/CVE-2015-8923>), [CVE-2015-8924](<https://vulners.com/cve/CVE-2015-8924>), [CVE-2015-8925](<https://vulners.com/cve/CVE-2015-8925>), [CVE-2015-8926](<https://vulners.com/cve/CVE-2015-8926>), [CVE-2015-8928](<https://vulners.com/cve/CVE-2015-8928>), [CVE-2015-8930](<https://vulners.com/cve/CVE-2015-8930>), [CVE-2015-8931](<https://vulners.com/cve/CVE-2015-8931>), [CVE-2015-8932](<https://vulners.com/cve/CVE-2015-8932>), [CVE-2015-8934](<https://vulners.com/cve/CVE-2015-8934>), [CVE-2016-1541](<https://vulners.com/cve/CVE-2016-1541>), [CVE-2016-4300](<https://vulners.com/cve/CVE-2016-4300>), [CVE-2016-4302](<https://vulners.com/cve/CVE-2016-4302>), [CVE-2016-4809](<https://vulners.com/cve/CVE-2016-4809>), [CVE-2016-5418](<https://vulners.com/cve/CVE-2016-5418>), [CVE-2016-5844](<https://vulners.com/cve/CVE-2016-5844>), [CVE-2016-6250](<https://vulners.com/cve/CVE-2016-6250>), [CVE-2016-7166](<https://vulners.com/cve/CVE-2016-7166>)\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-09-27T10:30:00", "type": "amazon", "title": "Important: libarchive", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2016-09-27T10:30:00", "id": "ALAS-2016-743", "href": "https://alas.aws.amazon.com/ALAS-2016-743.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "centos": [{"lastseen": "2023-12-03T17:05:42", "description": "**CentOS Errata and Security Advisory** CESA-2016:1844\n\n\nThe libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive. Specially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive. Specially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting CVE-2016-5418.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2016-September/084235.html\n\n**Affected packages:**\nbsdcpio\nbsdtar\nlibarchive\nlibarchive-devel\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2016:1844", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-09-16T00:18:58", "type": "centos", "title": "bsdcpio, bsdtar, libarchive security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2016-09-16T00:18:58", "id": "CESA-2016:1844", "href": "https://lists.centos.org/pipermail/centos-announce/2016-September/084235.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "oraclelinux": [{"lastseen": "2021-07-28T14:24:50", "description": "[3.1.2-10]\n- Fixes variation of CVE-2016-5418: Hard links could include '..' in their path.\n[3.1.2-9]\n- Fixes CVE-2016-5418: Archive Entry with type 1 (hardlink) causes file overwrite (#1365777)\n[3.1.2-8]\n- a bunch of security fixes (rhbz#1353065)", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "LOW", "baseScore": 8.6, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 4.7}, "published": "2016-09-12T00:00:00", "type": "oraclelinux", "title": "libarchive security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2016-09-12T00:00:00", "id": "ELSA-2016-1844", "href": "http://linux.oracle.com/errata/ELSA-2016-1844.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2023-10-20T10:38:44", "description": "The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)\n\n* Multiple out-of-bounds write flaws were found in libarchive. Specially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302)\n\n* Multiple out-of-bounds read flaws were found in libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)\n\n* Multiple NULL pointer dereference flaws were found in libarchive. Specially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)\n\n* Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930)\n\n* A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)\n\n* An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250)\n\n* Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844)\n\nRed Hat would like to thank Insomnia Security for reporting CVE-2016-5418.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2016-09-12T15:10:21", "type": "redhat", "title": "(RHSA-2016:1844) Important: libarchive security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166"], "modified": "2018-04-11T23:32:44", "id": "RHSA-2016:1844", "href": "https://access.redhat.com/errata/RHSA-2016:1844", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2023-12-03T17:36:23", "description": "### Background\n\nlibarchive is a library for manipulating different streaming archive formats, including certain tar variants, several cpio formats, and both BSD and GNU ar variants. \n\n### Description\n\nMultiple vulnerabilities have been discovered in libarchive. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted archive file possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll libarchive users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-arch/libarchive-3.2.2\"", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2017-01-01T00:00:00", "type": "gentoo", "title": "libarchive: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-2304", "CVE-2015-8915", "CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8918", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8927", "CVE-2015-8928", "CVE-2015-8929", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8933", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4301", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166", "CVE-2016-8687", "CVE-2016-8688", "CVE-2016-8689"], "modified": "2017-01-01T00:00:00", "id": "GLSA-201701-03", "href": "https://security.gentoo.org/glsa/201701-03", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
CVE-2016-1541
