Out-of-bounds read in libarchive - CVE-2017-14503

Vulnerability identifier: #VU15955

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-14503

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive. A remote attacker can trigger an out-of-bounds read, related to lha_crc16 and cause the service to crash.

libarchive
Debian Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
libarchive (Alpine package)
libarchive
Data Computing Appliance (DCA)

Install updates from vendor's website.

libarchive (Alpine package) - update to 3.3.3-r0
libarchive - addressed in versions 3.3.3-1.fc28, 3.3.3-1.fc29
Data Computing Appliance (DCA) - update to 4.3.0.0

• https://github.com/libarchive/libarchive/issues/948

• Multiple vulnerabilities in libarchive
• OpenSUSE Linux update for libarchive
• OpenSUSE Linux update for libarchive
• Debian update for libarchive
• Gentoo update for libarchive
• Red Hat update for libarchive
• Amazon Linux AMI update for libarchive
• Red Hat update for libarchive
• Out-of-bounds read in libarchive (Alpine package)
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Fedora 29 update for libarchive
• Fedora 28 update for libarchive