Vulnerability in libarchive - Buffer Overflow and Out of Bounds Read
Summary
DLA-661-1: libarchive - security update. Affects libarchive versions < 3.0.4-3+wheezy5. Fixed in 3.0.4-3+wheezy5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a multi-format archive and compression library. It provides functions for creating, reading, and manipulating various archive formats. The library is widely used in software applications that handle compressed files and archives. However, a security vulnerability has been discovered in libarchive that could allow an attacker to exploit buffer overflow and out of bounds read issues.
Vulnerability Detail
The vulnerability in libarchive arises from several flaws that can be exploited by an attacker using a carefully crafted input file. These flaws include a stack-based buffer overflow when printing a filename, an out of bounds read when parsing multiple long lines, and a heap-based buffer overflow when reading corrupted 7z files. If successfully exploited, these vulnerabilities could lead to arbitrary code execution or denial of service.
How To Fix
Minimum fixed version
3.0.4-3+wheezy5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for these vulnerabilities. It is essential to apply the security update to mitigate the risk.
Conclusion
The discovered vulnerabilities in libarchive could potentially allow an attacker to execute arbitrary code or cause denial of service. To mitigate the risk, it is crucial to update the libarchive package to the patched version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a multi-format archive and compression library used in various software applications.
If exploited, these vulnerabilities could allow an attacker to execute arbitrary code or cause denial of service.
To fix the vulnerability, update the libarchive package to version 3.0.4-3+wheezy5 or later.
No, there is no known workaround for these vulnerabilities. Applying the security update is necessary.
More information about Debian LTS security advisories can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
