CVE-2017-8847

CVE-2017-8847 affects lrzip 0.631 where the bufRead::get() function in libzpaq/libzpaq.h within liblrzip.so can dereference a NULL pointer when processing a crafted archive, enabling a denial of service (application crash). Public advisories consistently identify this vulnerability in Long Range ...

CVE-2017-8844

The read1g function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted archive...

CVE-2017-8846

The readstream function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service use-after-free and application crash via a crafted archive...

CVE-2017-8847

The bufRead::get function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted archive...

CVE-2017-8845

The lzo1xdecompress function in lzo1xd.ch in LZO 2.08, as used in lrzip 0.631, allows remote attackers to cause a denial of service invalid memory read and application crash via a crafted archive...

CVE-2017-8843

CVE-2017-8843 affects lrzip 0.631; the join_pthread function in stream.c (liblrzip.so) can be triggered by processing a crafted archive, causing a NULL pointer dereference and application crash (remote DoS). Remediation: upgrade to lrzip 0.631_p20190619 or newer (per Gentoo GLSA 202005-01 / DLA a...

CVE-2017-8842

The bufRead::get function in libzpaq/libzpaq.h in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted archive...

CVE-2017-8843

The joinpthread function in stream.c in liblrzip.so in lrzip 0.631 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted archive...

PT-2017-18574 · Lrzip +1 · Lrzip +1

Name of the Vulnerable Software and Affected Versions: lrzip version 0.631 Description: The issue allows remote attackers to cause a denial of service, resulting in a heap-based buffer overflow and application crash, or possibly have other unspecified impacts via a crafted archive. This is due to...

PT-2017-18573 · Lrzip · Lrzip

Name of the Vulnerable Software and Affected Versions: lrzip version 0.631 Description: The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a crafted archive. This is due to a problem in the join pthread function in...

PT-2017-18575 · Conan +1 · Lrzip +1

Name of the Vulnerable Software and Affected Versions: LZO version 2.08 lrzip version 0.631 Description: The issue allows remote attackers to cause a denial of service, resulting in an invalid memory read and application crash, via a crafted archive. This is due to a problem in the lzo1x decompre...

PT-2017-18577 · Lrzip · Lrzip

Name of the Vulnerable Software and Affected Versions: lrzip version 0.631 Description: The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a crafted archive. This is due to a problem in the bufRead::get function in...

PT-2017-18572 · Lrzip · Lrzip

Name of the Vulnerable Software and Affected Versions: lrzip version 0.631 Description: The issue is related to a divide-by-zero error and application crash that can be triggered by remote attackers via a crafted archive. This is caused by the bufRead::get function in libzpaq/libzpaq.h in...

MGASA-2017-0132 Updated libarchive packages fix security vulnerabilities

The archivewstringappendfrommbs function in archivestring.c in libarchive 3.2.2 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted archive file. CVE-2016-10209 The archivele32dec function in archiveendian.h in libarchive 3.2.2 allows...

Remote Code Execution (RCE)

github.com/docker/docker is vulnerable to arbitrary file writes and remote code execution RCE. Attackers can perform these attacks using a hard link image attack in an image archive or through a symlink attack...

Insecure Defaults

sosreport is vulnerable to insecure defaults. The library creates temporary archive files with world-readable permissions, allowing a malicious user to extract these files and read their contents. This vulnerability exists due to a regression in the default behavior of sosreport...

DEBIAN-CVE-2016-10350

The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file...

Heap overflow

The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file...

CVE-2016-10350

The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file...

CVE-2016-10350

The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service heap-based buffer over-read and application crash via a crafted file...