Veracode Vulnerability DatabaseVERACODE:17612Denial Of Service (DoS)
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
libarchive is vulnerable to denial of service (DOS) attacks. This exists because there is no limit to the number of recursive decompressions in libarchive which allows remote attackers to cause a denial of service condition via a crafted gzip file.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libarchive | eq | 2.8.3__4.el6_2 | |
| libarchive | eq | 2.8.3__3.el6_1 | |
| libarchive | eq | 2.8.3__2.el6 |
References
rhn.redhat.com/errata/RHSA-2016-1844.html
rhn.redhat.com/errata/RHSA-2016-1850.html
www.openwall.com/lists/oss-security/2016/09/08/15
www.openwall.com/lists/oss-security/2016/09/08/18
www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
www.securityfocus.com/bid/92901
access.redhat.com/security/updates/classification/#important
bugs.freebsd.org/bugzilla/show_bug.cgi?id=207362
bugzilla.redhat.com/show_bug.cgi?id=1347086
github.com/libarchive/libarchive/commit/6e06b1c89dd0d16f74894eac4cfc1327a06ee4a0
github.com/libarchive/libarchive/issues/660
rhn.redhat.com/errata/RHSA-2016-1850.html
security.gentoo.org/glsa/201701-03
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P