CVE-2013-0211: Buffer Overflow
Fabian Yamaguchi reported a read buffer overflow flaw in libarchive on 64-bit systems where sizeof(sizet) is equal to 8. In the archivewritezipdata() function in libarchive/archivewritesetformatzip.c, the "s" parameter is of type sizet (64 bit, unsigned) and is cast to a 64 bit signed integer. If "s" is larger than MAXINT, it will not be set to "zip->remainingdatabytes" even though it is larger than "zip->remainingdatabytes", which leads to a buffer overflow when calling deflate().
This can lead to a segfault in an application that uses libarchive to create ZIP archives.
Other sources
Integer signedness error in the archivewritezipdata function in archivewritesetformatzip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0211?
CVE-2013-0211 has been classified as a high severity vulnerability due to its read buffer overflow flaw.
How do I fix CVE-2013-0211?
To fix CVE-2013-0211, update libarchive to version 3.2.0 or later.
What systems are affected by CVE-2013-0211?
CVE-2013-0211 affects 64-bit systems running vulnerable versions of libarchive.
What functions are involved in the CVE-2013-0211 vulnerability?
The vulnerability is related to the archive_write_zip_data() function in the libarchive library.
Has CVE-2013-0211 been patched in Linux distributions?
Yes, various Linux distributions have included patches for CVE-2013-0211 in their updates.