Veracode Vulnerability DatabaseVERACODE:7066Denial Of Service (DoS) Through Integer Overflow
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
libarchive.so is vulnerable to denial of service (DoS) attacks. A malicious user can pass an archive file with a filename that when verified can cause an integer overflow, leading to a DoS or arbitrary code being executed.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libarchive.so | le | 12.0.4 |
References
rhn.redhat.com/errata/RHSA-2016-1844.html
www.openwall.com/lists/oss-security/2016/07/20/1
www.openwall.com/lists/oss-security/2016/07/21/3
www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
www.securityfocus.com/bid/92036
www.securitytracker.com/id/1036431
bugzilla.redhat.com/show_bug.cgi?id=1347085
github.com/libarchive/libarchive/commit/3014e198
github.com/libarchive/libarchive/commit/3014e19820ea53c15c90f9d447ca3e668a0b76c6
github.com/libarchive/libarchive/files/295073/libarchiveOverflow.txt
github.com/libarchive/libarchive/issues/711
security.gentoo.org/glsa/201701-03
Related
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P