NULL pointer dereference in libarchive - CVE-2016-10209
Published: November 19, 2018
Vulnerability identifier: #VU15950
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-10209
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in archive_string.c in libarchive allows remote attackers to trigger NULL pointer dereference and application crash via a specially crafted archive file.
Affected software
libarchive
Debian Linux
Fedora
Opensuse
BIG-IQ Centralized Management
BIG-IP
libarchive
Debian Linux
Fedora
Opensuse
BIG-IQ Centralized Management
BIG-IP
libarchive
How to mitigate CVE-2016-10209
Install update from vendor's website.
libarchive - addressed in versions 3.2.2-2.fc25, 3.2.2-4.fc26
External References
Related Security Bulletins
- Multiple vulnerabilities in libarchive
- OpenSUSE Linux update for libarchive
- Debian update for libarchive
- Multiple vulnerabilities in F5 BIG-IP configuration and tmsh utilities
- Multiple vulnerabilities in F5 BIG-IQ Centralized Management webUI and tmsh utility
- Fedora 26 update for libarchive
- Fedora 25 update for libarchive