Vulnerability in libarchive - security update
Summary
DLA-657-1: libarchive - security update. Affects libarchive versions < 3.0.4-3+wheezy4. Fixed in 3.0.4-3+wheezy4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a library and command-line tool used for reading and writing various archive formats. It provides functionality to create, extract, and manipulate archives. The vulnerability in libarchive affects version 3.0.4-3+wheezy4 of the Debian 7 Wheezy package. This vulnerability allows remote attackers to write to arbitrary files by exploiting mishandled hardlink archive entries of non-zero data size.
Vulnerability Detail
The vulnerability in libarchive arises from the mishandling of hardlink archive entries of non-zero data size. By crafting specially designed archives, remote attackers can exploit this vulnerability to write to arbitrary files. This can lead to unauthorized modification or disclosure of sensitive information, as well as potential system compromise.
How To Fix
Minimum fixed version
3.0.4-3+wheezy4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in libarchive can be mitigated by upgrading to the fixed version of the package. It is recommended to promptly apply the security update to ensure the integrity and security of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a library and command-line tool used for reading and writing various archive formats. It provides functionality to create, extract, and manipulate archives.
This vulnerability allows remote attackers to write to arbitrary files, potentially leading to unauthorized modification or disclosure of sensitive information and system compromise.
The vulnerability affects version 3.0.4-3+wheezy4 of the libarchive package in Debian 7 Wheezy.
To fix this vulnerability, upgrade the libarchive package to version 3.0.4-3+wheezy4 or later.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
