Vulnerability-Lookup

RHSA-2016_1844

Vulnerability from csaf_redhat - Published: 2016-09-12 20:11 - Updated: 2024-11-22 10:15

Summary

Red Hat Security Advisory: libarchive security update

Severity

Important

Notes

Topic: An update for libarchive is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418) * Multiple out-of-bounds write flaws were found in libarchive. Specially crafted ZIP, 7ZIP, or RAR files could cause a heap overflow, potentially allowing code execution in the context of the application using libarchive. (CVE-2016-1541, CVE-2016-4300, CVE-2016-4302) * Multiple out-of-bounds read flaws were found in libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP, TAR, or RAR files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8934) * Multiple NULL pointer dereference flaws were found in libarchive. Specially crafted RAR, CAB, or 7ZIP files could cause an application using libarchive to crash. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922) * Multiple infinite loop / resource exhaustion flaws were found in libarchive. Specially crafted GZIP or ISO files could cause the application to consume an excessive amount of resources, eventually leading to a crash on memory exhaustion. (CVE-2016-7166, CVE-2015-8930) * A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809) * An integer overflow flaw, leading to a buffer overflow, was found in libarchive's construction of ISO9660 volumes. Attempting to create an ISO9660 volume with 2 GB or 4 GB file names could cause the application to attempt to allocate 20 GB of memory. If this were to succeed, it could lead to an out of bounds write on the heap and potential code execution. (CVE-2016-6250) * Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted MTREE archives, Compress streams, or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8931, CVE-2015-8932, CVE-2016-5844) Red Hat would like to thank Insomnia Security for reporting CVE-2016-5418.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2015-8916

A vulnerability was found in libarchive. A specially crafted RAR file could cause the application dereference a NULL pointer, leading to a crash.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 240 products

Product	Version	Remediation
Unresolved product id: 7Client-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Client-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7ComputeNode-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Server-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdcpio-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:bsdtar-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.src	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-debuginfo-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.i686	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.ppc64le	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.s390x	—	Vendor Fix fix
Unresolved product id: 7Workstation-optional-7.2.Z:libarchive-devel-0:3.1.2-10.el7_2.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2015-8917

A vulnerability was found in libarchive. A specially crafted CAB file could cause the application dereference a NULL pointer, leading to a crash.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8919

A vulnerability was found in libarchive. A specially crafted LZA/LZH file could cause a small out-of-bounds read, potentially disclosing a few bytes of application memory.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8920

A vulnerability was found in libarchive. A specially crafted AR archive could cause the application to read a single byte of application memory, potentially disclosing it to the attacker.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8921

A vulnerability was found in libarchive. A specially crafted mtree file could cause libarchive to read beyond a statically declared structure, potentially disclosing application memory.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8922

A vulnerability was found in libarchive. A specially crafted 7Z file could trigger a NULL pointer dereference, causing the application to crash.

3.5 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8923

A vulnerability was found in libarchive. A specially crafted ZIP file could cause a few bytes of application memory in a 256-byte region to be disclosed.

3.5 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8924

A vulnerability was found in libarchive. A specially crafted TAR file could trigger an out-of-bounds read, potentially causing the application to disclose a small amount of application memory.

3.5 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8925

A vulnerability was found in libarchive. A specially crafted MTREE file could cause a small out-of-bounds read, potentially disclosing a small amount of application memory.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8926

A vulnerability was found in libarchive. A specially crafted RAR file could cause the application to disclose a 128k block of memory from an uncontrolled location.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8928

A vulnerability was found in libarchive. A specially crafted MTREE file could cause a limited out-of-bounds read, potentially disclosing contents of application memory.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8930

A vulnerability was found in libarchive. A specially crafted ISO file could cause the application to consume resources until it hit a memory limit, leading to a crash or denial of service.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8931

Undefined behavior (signed integer overflow) was discovered in libarchive, in the MTREE parser's calculation of maximum and minimum dates. A crafted mtree file could potentially cause denial of service.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8932

Undefined behavior (invalid left shift) was discovered in libarchive, in how Compress streams are identified. This could cause certain files to be mistakenly identified as Compress archives and fail to read.

3.5 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

CWE-682 - Incorrect Calculation

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2015-8934

A vulnerability was found in libarchive. A specially crafted RAR file could cause the application to read memory beyond the end of the decompression buffer.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2016-1541

A vulnerability was found in libarchive. A specially crafted zip file can provide an incorrect compressed size, which may allow an attacker to place arbitrary code on the heap and execute it in the context of the application.

8.4 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Moderate

CVE-2016-4300

A vulnerability was found in libarchive's handling of 7zip data. A specially crafted 7zip file can cause a integer overflow resulting in memory corruption that can lead to code execution.

8.4 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Moderate

CVE-2016-4302

A vulnerability was found in libarchive's handling of RAR archives. A specially crafted RAR file can cause a heap overflow, potentially leading to code execution in the context of the application.

7.7 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Moderate

CVE-2016-4809

A vulnerability was found in libarchive. A specially crafted cpio archive containing a symbolic link to a ridiculously large target path can cause memory allocation to fail, resulting in any attempt to view or extract the archive crashing.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2016-5418

A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Important

CVE-2016-5844

Undefined behavior (signed integer overflow) was discovered in libarchive, in the ISO parser. A crafted file could potentially cause denial of service.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2016-6250

A vulnerability was found in libarchive. An attempt to create an ISO9660 volume with 2GB or 4GB filenames could cause the application to crash.

7.9 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

CVE-2016-7166

A vulnerability was found in libarchive. A specially crafted gzip file can cause libarchive to allocate memory without limit, eventually leading to a crash.

3.5 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 240 products, the same list as for CVE-2015-8916

Threats

Impact Low

References

122 references

URL	Category
https://access.redhat.com/errata/RHSA-2016:1844	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=1334211	external
https://bugzilla.redhat.com/show_bug.cgi?id=1347084	external
https://bugzilla.redhat.com/show_bug.cgi?id=1347085	external
https://bugzilla.redhat.com/show_bug.cgi?id=1347086	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348412	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348413	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348414	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348416	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348419	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348421	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348423	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348424	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348429	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348439	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348444	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348772	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348773	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348779	external
https://bugzilla.redhat.com/show_bug.cgi?id=1348780	external
https://bugzilla.redhat.com/show_bug.cgi?id=1349204	external
https://bugzilla.redhat.com/show_bug.cgi?id=1349229	external
https://bugzilla.redhat.com/show_bug.cgi?id=1350280	external
https://bugzilla.redhat.com/show_bug.cgi?id=1362601	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2015-8916	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348412	external
https://www.cve.org/CVERecord?id=CVE-2015-8916	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8916	external
https://access.redhat.com/security/cve/CVE-2015-8917	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348413	external
https://www.cve.org/CVERecord?id=CVE-2015-8917	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8917	external
https://access.redhat.com/security/cve/CVE-2015-8919	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348414	external
https://www.cve.org/CVERecord?id=CVE-2015-8919	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8919	external
https://access.redhat.com/security/cve/CVE-2015-8920	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348416	external
https://www.cve.org/CVERecord?id=CVE-2015-8920	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8920	external
https://access.redhat.com/security/cve/CVE-2015-8921	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348772	external
https://www.cve.org/CVERecord?id=CVE-2015-8921	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8921	external
https://access.redhat.com/security/cve/CVE-2015-8922	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348419	external
https://www.cve.org/CVERecord?id=CVE-2015-8922	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8922	external
https://access.redhat.com/security/cve/CVE-2015-8923	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348773	external
https://www.cve.org/CVERecord?id=CVE-2015-8923	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8923	external
https://access.redhat.com/security/cve/CVE-2015-8924	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348421	external
https://www.cve.org/CVERecord?id=CVE-2015-8924	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8924	external
https://access.redhat.com/security/cve/CVE-2015-8925	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348423	external
https://www.cve.org/CVERecord?id=CVE-2015-8925	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8925	external
https://access.redhat.com/security/cve/CVE-2015-8926	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348424	external
https://www.cve.org/CVERecord?id=CVE-2015-8926	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8926	external
https://access.redhat.com/security/cve/CVE-2015-8928	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348429	external
https://www.cve.org/CVERecord?id=CVE-2015-8928	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8928	external
https://access.redhat.com/security/cve/CVE-2015-8930	self
https://bugzilla.redhat.com/show_bug.cgi?id=1349204	external
https://www.cve.org/CVERecord?id=CVE-2015-8930	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8930	external
https://access.redhat.com/security/cve/CVE-2015-8931	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348779	external
https://www.cve.org/CVERecord?id=CVE-2015-8931	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8931	external
https://access.redhat.com/security/cve/CVE-2015-8932	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348780	external
https://www.cve.org/CVERecord?id=CVE-2015-8932	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8932	external
https://access.redhat.com/security/cve/CVE-2015-8934	self
https://bugzilla.redhat.com/show_bug.cgi?id=1349229	external
https://www.cve.org/CVERecord?id=CVE-2015-8934	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8934	external
https://access.redhat.com/security/cve/CVE-2016-1541	self
https://bugzilla.redhat.com/show_bug.cgi?id=1334211	external
https://www.cve.org/CVERecord?id=CVE-2016-1541	external
https://nvd.nist.gov/vuln/detail/CVE-2016-1541	external
http://www.kb.cert.org/vuls/id/862384	external
https://access.redhat.com/security/cve/CVE-2016-4300	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348439	external
https://www.cve.org/CVERecord?id=CVE-2016-4300	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4300	external
http://www.talosintel.com/reports/TALOS-2016-0152/	external
https://access.redhat.com/security/cve/CVE-2016-4302	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348444	external
https://www.cve.org/CVERecord?id=CVE-2016-4302	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4302	external
http://www.talosintel.com/reports/TALOS-2016-0154/	external
https://access.redhat.com/security/cve/CVE-2016-4809	self
https://bugzilla.redhat.com/show_bug.cgi?id=1347084	external
https://www.cve.org/CVERecord?id=CVE-2016-4809	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4809	external
https://access.redhat.com/security/cve/CVE-2016-5418	self
https://bugzilla.redhat.com/show_bug.cgi?id=1362601	external
https://www.cve.org/CVERecord?id=CVE-2016-5418	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5418	external
http://seclists.org/oss-sec/2016/q3/255	external
https://access.redhat.com/security/cve/CVE-2016-5844	self
https://bugzilla.redhat.com/show_bug.cgi?id=1350280	external
https://www.cve.org/CVERecord?id=CVE-2016-5844	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5844	external
https://access.redhat.com/security/cve/CVE-2016-6250	self
https://bugzilla.redhat.com/show_bug.cgi?id=1347085	external
https://www.cve.org/CVERecord?id=CVE-2016-6250	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6250	external
https://access.redhat.com/security/cve/CVE-2016-7166	self
https://bugzilla.redhat.com/show_bug.cgi?id=1347086	external
https://www.cve.org/CVERecord?id=CVE-2016-7166	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7166	external

Acknowledgments

Insomnia Security

JSON

To clipboard

Loading 1.4 MB of JSON…

CVE-2015-8916 (GCVE-0-2015-8916)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.securityfocus.com/bid/91296	vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://security-tracker.debian.org/tracker/CVE-2…	x_refsource_CONFIRM
https://github.com/libarchive/libarchive/issues/504	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:29.921Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "91296",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91296"
          },
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2015-8916"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/504"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a \"split file in multivolume RAR,\" which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "91296",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91296"
        },
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2015-8916"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/504"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8916",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a \"split file in multivolume RAR,\" which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "91296",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91296"
            },
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2015-8916",
              "refsource": "CONFIRM",
              "url": "https://security-tracker.debian.org/tracker/CVE-2015-8916"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/504",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/504"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8916",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:29.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8917 (GCVE-0-2015-8917)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://github.com/libarchive/libarchive/issues/505	x_refsource_CONFIRM
http://www.securityfocus.com/bid/91303	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
https://security-tracker.debian.org/tracker/CVE-2…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2016-06-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.394Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/505"
          },
          {
            "name": "91303",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91303"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2015-8917"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-06-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/505"
        },
        {
          "name": "91303",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91303"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2015-8917"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8917",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/505",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/505"
            },
            {
              "name": "91303",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91303"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "https://security-tracker.debian.org/tracker/CVE-2015-8917",
              "refsource": "CONFIRM",
              "url": "https://security-tracker.debian.org/tracker/CVE-2015-8917"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8917",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8919 (GCVE-0-2015-8919)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.securityfocus.com/bid/91302	vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://github.com/libarchive/libarchive/issues/510	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:29.924Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "91302",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91302"
          },
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/510"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "91302",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91302"
        },
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/510"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8919",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "91302",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91302"
            },
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/510",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/510"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8919",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:29.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8920 (GCVE-0-2015-8920)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

12 references

URL	Tags
http://www.securityfocus.com/bid/91301	vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://github.com/libarchive/libarchive/issues/511	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-1850.html	vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.439Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "91301",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91301"
          },
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/511"
          },
          {
            "name": "RHSA-2016:1850",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1850.html"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "91301",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91301"
        },
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/511"
        },
        {
          "name": "RHSA-2016:1850",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1850.html"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8920",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "91301",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91301"
            },
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/511",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/511"
            },
            {
              "name": "RHSA-2016:1850",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1850.html"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8920",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8921 (GCVE-0-2015-8921)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

12 references

URL	Tags
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2016-1850.html	vendor-advisoryx_refsource_REDHAT
https://github.com/libarchive/libarchive/issues/512	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/91307	vdb-entryx_refsource_BID

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "name": "RHSA-2016:1850",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1850.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/512"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          },
          {
            "name": "91307",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91307"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "name": "RHSA-2016:1850",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1850.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/512"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        },
        {
          "name": "91307",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91307"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8921",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "RHSA-2016:1850",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1850.html"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/512",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/512"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            },
            {
              "name": "91307",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91307"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8921",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8922 (GCVE-0-2015-8922)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

12 references

URL	Tags
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
https://github.com/libarchive/libarchive/issues/513	x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://www.suse.com/security/cve/CVE-2015-8922.html	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/91312	vdb-entryx_refsource_BID
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:29.936Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/513"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.suse.com/security/cve/CVE-2015-8922.html"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "91312",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91312"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/513"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.suse.com/security/cve/CVE-2015-8922.html"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "91312",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91312"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8922",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/513",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/513"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "https://www.suse.com/security/cve/CVE-2015-8922.html",
              "refsource": "CONFIRM",
              "url": "https://www.suse.com/security/cve/CVE-2015-8922.html"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "91312",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91312"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8922",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:29.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8923 (GCVE-0-2015-8923)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
https://github.com/libarchive/libarchive/issues/514	x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/91309	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:29.935Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/514"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "name": "91309",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91309"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/514"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "name": "91309",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91309"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8923",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/514",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/514"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "91309",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91309"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8923",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:29.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8924 (GCVE-0-2015-8924)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/91308	vdb-entryx_refsource_BID
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN
https://github.com/libarchive/libarchive/issues/515	x_refsource_CONFIRM

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:30.339Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "name": "91308",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91308"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/515"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "name": "91308",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91308"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/515"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8924",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "91308",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91308"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/515",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/515"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8924",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:30.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8925 (GCVE-0-2015-8925)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://github.com/libarchive/libarchive/issues/516	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/91306	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:29.917Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/516"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "name": "91306",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91306"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/516"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "name": "91306",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91306"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8925",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/516",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/516"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "91306",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91306"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8925",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:29.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-8926 (GCVE-0-2015-8926)

Vulnerability from cvelistv5 – Published: 2016-09-20 14:00 – Updated: 2024-08-06 08:36

Summary

The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

11 references

URL	Tags
http://www.ubuntu.com/usn/USN-3033-1	vendor-advisoryx_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2016-1844.html	vendor-advisoryx_refsource_REDHAT
https://blog.fuzzing-project.org/47-Many-invalid-…	x_refsource_MISC
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/91304	vdb-entryx_refsource_BID
https://github.com/libarchive/libarchive/issues/518	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/06/17/2	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/201701-03	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2016/06/17/5	mailing-listx_refsource_MLIST
http://www.debian.org/security/2016/dsa-3657	vendor-advisoryx_refsource_DEBIAN

Date Public

2015-04-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:36:31.538Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3033-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3033-1"
          },
          {
            "name": "RHSA-2016:1844",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
          },
          {
            "name": "SUSE-SU-2016:1909",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
          },
          {
            "name": "91304",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91304"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libarchive/libarchive/issues/518"
          },
          {
            "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
          },
          {
            "name": "GLSA-201701-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201701-03"
          },
          {
            "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
          },
          {
            "name": "DSA-3657",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3657"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-04-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3033-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3033-1"
        },
        {
          "name": "RHSA-2016:1844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
        },
        {
          "name": "SUSE-SU-2016:1909",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
        },
        {
          "name": "91304",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/91304"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libarchive/libarchive/issues/518"
        },
        {
          "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
        },
        {
          "name": "GLSA-201701-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201701-03"
        },
        {
          "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
        },
        {
          "name": "DSA-3657",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3657"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8926",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3033-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3033-1"
            },
            {
              "name": "RHSA-2016:1844",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1844.html"
            },
            {
              "name": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html",
              "refsource": "MISC",
              "url": "https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html"
            },
            {
              "name": "SUSE-SU-2016:1909",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html"
            },
            {
              "name": "91304",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/91304"
            },
            {
              "name": "https://github.com/libarchive/libarchive/issues/518",
              "refsource": "CONFIRM",
              "url": "https://github.com/libarchive/libarchive/issues/518"
            },
            {
              "name": "[oss-security] 20160617 Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/2"
            },
            {
              "name": "GLSA-201701-03",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201701-03"
            },
            {
              "name": "[oss-security] 20160617 Re: Many invalid memory access issues in libarchive",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/06/17/5"
            },
            {
              "name": "DSA-3657",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3657"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8926",
    "datePublished": "2016-09-20T14:00:00.000Z",
    "dateReserved": "2016-06-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T08:36:31.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2016_1844

CVE-2015-8916 (GCVE-0-2015-8916)

CVE-2015-8917 (GCVE-0-2015-8917)

CVE-2015-8919 (GCVE-0-2015-8919)

CVE-2015-8920 (GCVE-0-2015-8920)

CVE-2015-8921 (GCVE-0-2015-8921)

CVE-2015-8922 (GCVE-0-2015-8922)

CVE-2015-8923 (GCVE-0-2015-8923)

CVE-2015-8924 (GCVE-0-2015-8924)

CVE-2015-8925 (GCVE-0-2015-8925)

CVE-2015-8926 (GCVE-0-2015-8926)

Tags

Sightings

Nomenclature

Related by attack behaviour