Vulnerability in libarchive - Security Update
Summary
DLA-1006-1: libarchive - security update. Affects libarchive versions < 3.0.4-3+wheezy6. Fixed in 3.0.4-3+wheezy6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a library for reading and writing various archive formats. It provides functionality to manipulate archives, including compression and decompression. The library is widely used in many applications and is an essential component for handling archives in the Debian 7 Wheezy ecosystem.
Vulnerability Detail
Multiple denial of service vulnerabilities have been discovered in libarchive. These vulnerabilities can be exploited by manipulating specially crafted archives. The specific vulnerabilities are as follows:
-
CVE-2016-10209: This vulnerability involves a NULL pointer dereference and application crash in the archive_wstring_append_from_mbs() function.
-
CVE-2016-10349: This vulnerability is a heap-based buffer over-read and application crash in the archive_le32dec() function.
-
CVE-2016-10350: This vulnerability is a heap-based buffer over-read and application crash in the archive_read_format_cab_read_header() function.
These vulnerabilities can lead to application crashes and potential denial of service attacks.
How To Fix
Minimum fixed version
3.0.4-3+wheezy6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple denial of service vulnerabilities have been identified in libarchive. It is crucial to upgrade the libarchive packages to the fixed version to mitigate the risk of application crashes and potential denial of service attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a library for reading and writing various archive formats. It provides functionality to manipulate archives, including compression and decompression.
These vulnerabilities can lead to application crashes and potential denial of service attacks.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to upgrade to the fixed version of libarchive.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
