CVE-2015-8916: Null Pointer Dereference
bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8916?
CVE-2015-8916 has a severity rating that indicates a potential denial of service that may cause application crashes.
How do I fix CVE-2015-8916?
To fix CVE-2015-8916, update libarchive to version 3.2.0 or later.
What types of attacks can exploit CVE-2015-8916?
CVE-2015-8916 can be exploited through crafted RAR files that can lead to a NULL pointer dereference.
Which software versions are vulnerable to CVE-2015-8916?
Versions of libarchive prior to 3.2.0, including 3.1.901a and earlier, are vulnerable to CVE-2015-8916.
Is CVE-2015-8916 present in Debian or Ubuntu systems?
Yes, CVE-2015-8916 affects specific versions of Debian and Ubuntu systems that utilize vulnerable libarchive packages.