CVE-2016-4300: Integer Overflow
An exploitable heap overflow vulnerability exists in the 7zip readSubStreamsInfo functionality of libarchive. A specially crafted 7zip file can cause a integer overflow resulting in memory corruption that can lead to code execution. An attacker can send a malformed file to trigger this vulnerability.
External references:
http://www.talosintel.com/reports/TALOS-2016-0152/
Upstream fix:
https://github.com/libarchive/libarchive/commit/e79ef306afe332faf22e9b442a2c6b59cb175573
Other sources
Integer overflow in the readSubStreamsInfo function in archivereadsupportformat7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4300?
CVE-2016-4300 is categorized as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2016-4300?
To mitigate CVE-2016-4300, update the libarchive package to version 3.2.1 or later.
What causes the vulnerability CVE-2016-4300?
CVE-2016-4300 is caused by a heap overflow in the read_SubStreamsInfo functionality of libarchive when processing specially crafted 7zip files.
What are the affected software versions for CVE-2016-4300?
CVE-2016-4300 affects libarchive versions up to 3.2.0 and specific versions of Red Hat Enterprise Linux 7.0 and 7.2.
Can CVE-2016-4300 be exploited remotely?
Yes, an attacker can exploit CVE-2016-4300 remotely by sending a specially crafted 7zip file.