RHSA-2016:1844 — Red Hat Security Advisory: libarchive security update

Fixed packages 20

Release	Package	Fixed in
Red Hat · RHEL 7 enterprise_linux:7::client	bsdcpio	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client	bsdtar	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client	libarchive	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client	libarchive-debuginfo	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client	libarchive-devel	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode	bsdcpio	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode	bsdtar	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode	libarchive	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode	libarchive-debuginfo	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode	libarchive-devel	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	bsdcpio	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	bsdtar	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	libarchive	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	libarchive-debuginfo	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	libarchive-devel	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	bsdcpio	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	bsdtar	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	libarchive	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	libarchive-debuginfo	0:3.1.2-10.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	libarchive-devel	0:3.1.2-10.el7_2

Vulnerabilities 23

Unscored —

CVE-2015-8916

bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in …

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8917

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and cr…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8919

The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remot…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8920

The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to …

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8921 EPSS 12%

The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of …

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8922

The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers t…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8923

The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allow…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8924

The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8925

The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to caus…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8926

The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows r…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8928

The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attacker…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8930

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with …

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8931

Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mt…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8932

The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote at…

libarchive libarchive Debian Ubuntu

Sep 20, 2016
Unscored —

CVE-2015-8934

The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote a…

libarchive libarchive libarchive Debian Ubuntu Alpine

Sep 20, 2016
Unscored —

CVE-2016-1541 EPSS 10%

Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive bef…

libarchive libarchive libarchive Debian Ubuntu Alpine

May 7, 2016
Unscored —

CVE-2016-4300

Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 a…

libarchive libarchive libarchive Debian Ubuntu Alpine

Sep 21, 2016
Unscored —

CVE-2016-4302

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 …

libarchive libarchive libarchive Debian Ubuntu Alpine

Sep 21, 2016
Unscored —

CVE-2016-4809

The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allo…

libarchive libarchive libarchive Debian Ubuntu Alpine

Sep 21, 2016
Unscored —

CVE-2016-5418

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mi…

libarchive libarchive Debian Ubuntu

Sep 21, 2016
Unscored —

CVE-2016-5844

Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (app…

libarchive libarchive libarchive Debian Ubuntu Alpine

Sep 21, 2016
Unscored —

CVE-2016-6250

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service …

libarchive libarchive libarchive Debian Ubuntu Alpine

Sep 21, 2016
Unscored —

CVE-2016-7166

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a…

libarchive libarchive Debian Ubuntu

Sep 21, 2016

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=1334211
report
https://bugzilla.redhat.com/show_bug.cgi?id=1347084
report
https://bugzilla.redhat.com/show_bug.cgi?id=1347085
report
https://bugzilla.redhat.com/show_bug.cgi?id=1347086
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348412
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348413
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348414
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348416
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348419
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348421
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348423
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348424
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348429
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348439
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348444
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348772
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348773
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348779
report
https://bugzilla.redhat.com/show_bug.cgi?id=1348780
report
https://bugzilla.redhat.com/show_bug.cgi?id=1349204
report
https://bugzilla.redhat.com/show_bug.cgi?id=1349229
report
https://bugzilla.redhat.com/show_bug.cgi?id=1350280
report
https://bugzilla.redhat.com/show_bug.cgi?id=1362601
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1844.json
report
https://access.redhat.com/security/cve/CVE-2015-8916
advisory
https://www.cve.org/CVERecord?id=CVE-2015-8916
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-8916
report
https://access.redhat.com/security/cve/CVE-2015-8917
advisory
https://www.cve.org/CVERecord?id=CVE-2015-8917
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-8917
report
https://access.redhat.com/security/cve/CVE-2015-8919
advisory
https://www.cve.org/CVERecord?id=CVE-2015-8919
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-8919
report
https://access.redhat.com/security/cve/CVE-2015-8920
advisory
https://www.cve.org/CVERecord?id=CVE-2015-8920
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-8920
report
https://access.redhat.com/security/cve/CVE-2015-8921
advisory
https://www.cve.org/CVERecord?id=CVE-2015-8921

Red Hat Security Advisory: libarchive security update

Fixed packages 20

Vulnerabilities 23

bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in …

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and cr…

The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remot…

The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to …

The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of …

The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers t…

The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allow…

The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows…

The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to caus…

The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows r…

The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attacker…

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with …

Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mt…

The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote at…

The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote a…

Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive bef…

Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 a…

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 …

The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allo…

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mi…

Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (app…

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service …

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a…

References