Security Update for libarchive
Summary
DLA-617-1: libarchive - security update. Affects libarchive versions < 3.0.4-3+wheezy3. Fixed in 3.0.4-3+wheezy3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libarchive is a multi-format archive and compression library used by various applications. It provides functionality for creating, reading, and extracting files from different archive formats. The library is vulnerable to two security issues that could be exploited by an attacker to cause a denial of service or execute arbitrary code.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-8915, allows an attacker to trigger an out-of-bounds memory read in libarchive's bsdtar utility. By providing a specially crafted file, the attacker can cause bsdtar to read beyond the allocated memory, leading to a segmentation fault.
The second vulnerability, known as CVE-2016-7166, affects libarchive's compression handling. By supplying a malicious gzip file, an attacker can trigger an infinite chain of gzip compressors, consuming all available memory or triggering resource limits.
How To Fix
Minimum fixed version
3.0.4-3+wheezy3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
libarchive is a multi-format archive and compression library that has been found to have two security vulnerabilities. These vulnerabilities can be fixed by upgrading the libarchive package to version 3.0.4-3+wheezy3 or later. It is important to apply the security update to protect against potential exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a multi-format archive and compression library used by various applications. It provides functionality for creating, reading, and extracting files from different archive formats.
CVE-2015-8915 is a vulnerability in libarchive's bsdtar utility. It allows an attacker to trigger an out-of-bounds memory read by providing a specially crafted file, leading to a segmentation fault.
CVE-2016-7166 is a vulnerability in libarchive's compression handling. By supplying a malicious gzip file, an attacker can trigger an infinite chain of gzip compressors, consuming all available memory or triggering resource limits.
To fix these vulnerabilities, you should upgrade the libarchive package to version 3.0.4-3+wheezy3 or later. This can be done using the package manager update command specific to your operating system.
No specific workarounds are mentioned for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
