CVE-2016-2347: Integer Overflow
Integer underflow in the decodelevel3header function in lib/lhafileheader.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/lhasato a version that resolves this vulnerability.Fixed in 0.0.7-2+deb7u1ubuntu0.14.04.1 - Upgrade
Upgrade
ubuntu/lhasato a version that resolves this vulnerability.Fixed in 0.3.0-2ubuntu0.1~esm1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2347?
CVE-2016-2347 has a high severity rating allowing remote attackers to potentially execute arbitrary code.
How do I fix CVE-2016-2347?
To fix CVE-2016-2347, update to a version of Lhasa greater than 0.3.0 or apply the available security patches for your operating system.
Which software is affected by CVE-2016-2347?
CVE-2016-2347 affects Lhasa versions prior to 0.3.1 and specific versions of openSUSE and Debian Linux.
What type of vulnerability is CVE-2016-2347?
CVE-2016-2347 is categorized as an integer underflow vulnerability that impacts the decode_level3_header function.
Is CVE-2016-2347 remotely exploitable?
Yes, CVE-2016-2347 can be exploited remotely through crafted archive files.