Buffer over-read in libarchive - CVE-2016-10350
Published: November 19, 2018
Vulnerability identifier: #VU15953
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-10350
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2. A remote attacker can trigger heap-based buffer over-read and application crash via a specially crafted file.
Affected software
libarchive
Debian Linux
Gentoo Linux
Fedora
Opensuse
BIG-IQ Centralized Management
BIG-IP
libarchive
Debian Linux
Gentoo Linux
Fedora
Opensuse
BIG-IQ Centralized Management
BIG-IP
libarchive
How to mitigate CVE-2016-10350
Install update from vendor's website.
libarchive - addressed in versions 3.3.3-1.fc28, 3.3.3-1.fc29
External References
Related Security Bulletins
- Multiple vulnerabilities in libarchive
- OpenSUSE Linux update for libarchive
- Debian update for libarchive
- Gentoo update for libarchive
- Multiple vulnerabilities in F5 BIG-IP configuration and tmsh utilities
- Multiple vulnerabilities in F5 BIG-IQ Centralized Management webUI and tmsh utility
- Fedora 29 update for libarchive
- Fedora 28 update for libarchive