Heap Buffer Overflow in libarchive
Summary
DLA-810-1: libarchive - security update. Affects libarchive versions < 3.0.4-3+wheezy5+deb7u1. Fixed in 3.0.4-3+wheezy5+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a multi-format archive and compression library. It provides functions for creating, reading, and manipulating various archive formats, including tar, cpio, zip, and more. This vulnerability affects libarchive in Debian 7 Wheezy.
Vulnerability Detail
A heap buffer overflow vulnerability was discovered in libarchive. This type of vulnerability occurs when a program writes more data to a buffer than it can hold, leading to memory corruption. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
3.0.4-3+wheezy5+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, a heap buffer overflow vulnerability has been discovered in libarchive. It is recommended to upgrade the libarchive package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a multi-format archive and compression library used for creating, reading, and manipulating various archive formats.
A heap buffer overflow is a type of vulnerability where a program writes more data to a buffer than it can hold, leading to memory corruption.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service.
To fix this vulnerability, you should upgrade the libarchive package to version 3.0.4-3+wheezy5+deb7u1 or later.
You can get the updated libarchive package from the official Debian repository.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
