libarchive heap buffer overflow vulnerability (CNVD-2016-10129)

libarchive is a multi-format archive and compression library. A heap buffer overflow vulnerability exists in libarchive version 3.2.1, which can be exploited by remote attackers to execute arbitrary code or cause a denial-of-service condition, denying service to legitimate users...

Libarchive Buffer Overflow Vulnerability

libarchive is a multi-format archive and compression library. A buffer overflow vulnerability exists in the libarchive function bsdtarexpandchar. This allows an attacker to exploit the vulnerability to execute arbitrary script code in the context of an affected program...

Debian DLA-661-1 : libarchive security update

Agostino Sarubbo of Gentoo discovered several security vulnerabilities in libarchive, a multi-format archive and compression library. An attacker could take advantage of these flaws to cause a buffer overflow or an out of bounds read using a carefully crafted input file. CVE-2016-8687 Agostino...

[SECURITY] [DLA 661-1] libarchive security update

Package : libarchive Version : 3.0.4-3+wheezy5 CVE ID : CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 Debian Bug : 840934 840935 840936 Agostino Sarubbo of Gentoo discovered several security vulnerabilities in libarchive, a multi-format archive and compression library. An attacker could take advantag...

CVE-2016-8689

The readHeader function in archivereadsupportformat7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service out-of-bounds read via multiple EmptyStream attributes in a header in a 7zip archive...

CVE-2016-8688

The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service crash via a crafted file, which triggers an invalid read in the 1 detectform or 2 bidentry function in...

Debian DLA-657-1 : libarchive security update

It was found that libarchive mishandled hardlink archive entries of non-zero data size, possibly allowing remote attackers to to write to arbitrary files via especially crafted archives. For Debian 7 'Wheezy', these problems have been fixed in version 3.0.4-3+wheezy4. We recommend that you upgrad...

DLA-661-1 libarchive - security update

Bulletin has no description...

[SECURITY] [DLA 657-1] libarchive security update

Package : libarchive Version : 3.0.4-3+wheezy4 CVE ID : CVE-2016-5418 Debian Bug : 837714 It was found that libarchive mishandled hardlink archive entries of non-zero data size, possibly allowing remote attackers to to write to arbitrary files via especially crafted archives. For Debian 7 "Wheezy...

DLA-657-1 libarchive - security update

Bulletin has no description...

The vulnerability of the Mac OS X operating system, which allows a perpetrator to trigger a service failure or cause other adverse effects

The vulnerability of the libarchive component in the Mac OS X operating system arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure memory corruption or other effects through a specially...

FreeBSD : FreeBSD -- Multiple libarchive vulnerabilities (1a71a972-8ee7-11e6-a590-14dae9d210b8)

Flaws in libarchive's handling of symlinks and hard links allow overwriting files outside the extraction directory, or permission changes to a directory outside the extraction directory. Impact : An attacker who can control freebsd-update's or portsnap's input to tar1 can change file content or...

FreeBSD-SA-16:31.libarchive

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:31.libarchive Security Advisory The FreeBSD Project Topic: Multiple libarchive vulnerabilities Category: core Module: portsnap Announced: 2016-10-05 Affects:...

Heap-buffer-overflow in archive_read_format_cpio_read_header

Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4798906516897792 Fuzzer: libFuzzerlibarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x61900014e080 Crash State: archivereadformatcpioreadheader...

FreeBSD -- Multiple libarchive vulnerabilities

Problem Description: Flaws in libarchive's handling of symlinks and hard links allow overwriting files outside the extraction directory, or permission changes to a directory outside the extraction directory. Impact: An attacker who can control freebsd-update's or portsnap's input to tar1 can chan...

Apple OS X libarchive Memory Corruption Vulnerability

Apple OS X is a specialized operating system developed by Apple for Mac computers. libarchive is a multi-format archive and compression library component of it. A memory corruption vulnerability exists in libarchive in Apple OS X versions prior to 10.12, which can be exploited by remote attackers...

Amazon Linux AMI : libarchive (ALAS-2016-743)

A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. CVE-2016-5418 Multiple...

Important: libarchive

Issue Overview: A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive...

Debian DSA-3677-1 : libarchive - security update

Several vulnerabilities were discovered in libarchive, a multi-format archive and compression library, which may lead to denial of service memory consumption and application crash, bypass of sandboxing restrictions and overwrite arbitrary files with arbitrary data from an archive, or the executio...

Updated libarchive packages fix security vulnerability

The updated packages fix several security vulnerabilities: A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with...