openSUSE Security Update : libarchive (openSUSE-2016-762)

This update for libarchive fixes the following issue : - Fix a heap-based buffer overflow CVE-2016-1541, bsc979005 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

CVE-2015-8934

A vulnerability was found in libarchive. A specially crafted RAR file could cause the application to read memory beyond the end of the decompression buffer...

CVE-2015-8930

A vulnerability was found in libarchive. A specially crafted ISO file could cause the application to consume resources until it hit a memory limit, leading to a crash or denial of service...

libarchive Rar decompression function stack buffer overflow vulnerability

libarchive is a multi-format archive and compression library. A stack buffer overflow vulnerability exists in the Rar decompression feature of libarchive. An attacker can exploit this vulnerability to cause a denial of service memory corruption or execute arbitrary code via a specially crafted Ra...

UBUNTU-CVE-2016-4300

Integer overflow in the readSubStreamsInfo function in archivereadsupportformat7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow...

UBUNTU-CVE-2016-4302

Heap-based buffer overflow in the parsecodes function in archivereadsupportformatrar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary...

libarchive -- multiple vulnerabilities

Hanno Bock and Cisco Talos report: Out of bounds heap read in RAR parser Signed integer overflow in ISO parser TALOS-2016-0152 CVE-2016-4300: 7-Zip readSubStreamsInfo Integer Overflow TALOS-2016-0153 CVE-2016-4301: mtree parsedevice Stack Based Buffer Overflow TALOS-2016-0154 CVE-2016-4302:...

libarchive 7zip read_SubStreamsInfo Function Heap Buffer Overflow Vulnerability

libarchive is a multi-format archive and compression library. A heap buffer overflow vulnerability exists in the 7zip readSubStreamsInfo function in libarchive version 3.1.2. An attacker can exploit this vulnerability with a specially crafted 7zip file to cause a denial of service memory...

CVE-2016-4300

Integer overflow in the readSubStreamsInfo function in archivereadsupportformat7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow...

libarchive mtree parse_device function stack buffer overflow vulnerability

libarchive is a multi-format archive and compression library. A stack buffer overflow vulnerability exists in the mtree parsedevice function in libarchive version 3.1.2. An attacker can exploit this vulnerability with a specially crafted mtree file to cause a denial of service memory corruption, ...

CVE-2016-4302

Heap-based buffer overflow in the parsecodes function in archivereadsupportformatrar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary...

Patched libarchive Vulnerabilities Have Big Reach

The libarchive programming library was recently patched against three critical memory-related vulnerabilities that could be abused to execute code on computers running the vulnerable software. As is the case with most open source software packages, patching the core library is only half the battl...

CVE-2015-8918

The archivestringappend function in archivestring.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service crash via a crafted cab files, related to "overlapping memcpy."...

CVE-2015-8919

A vulnerability was found in libarchive. A specially crafted LZA/LZH file could cause a small out-of-bounds read, potentially disclosing a few bytes of application memory...

CVE-2015-8916

A vulnerability was found in libarchive. A specially crafted RAR file could cause the application dereference a NULL pointer, leading to a crash...

CVE-2015-8917

A vulnerability was found in libarchive. A specially crafted CAB file could cause the application dereference a NULL pointer, leading to a crash...

CVE-2015-8931

Undefined behavior signed integer overflow was discovered in libarchive, in the MTREE parser's calculation of maximum and minimum dates. A crafted mtree file could potentially cause denial of service...

CVE-2015-8932

Undefined behavior invalid left shift was discovered in libarchive, in how Compress streams are identified. This could cause certain files to be mistakenly identified as Compress archives and fail to read...

CVE-2015-8933

Integer overflow in the archivereadformattarskip function in archivereadsupportformattar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service crash via a crafted tar file...

CVE-2015-8926

A vulnerability was found in libarchive. A specially crafted RAR file could cause the application to disclose a 128k block of memory from an uncontrolled location...