CVE-2016-4809: Input Validation
A cpio archive with a ridiculously large symlink can cause memory allocation to fail, resulting in any attempt to view or extract the archive crashing. The failed allocation appears to be handled correctly within libarchive and not lead to further issues.
External references: https://github.com/libarchive/libarchive/issues/705
Upstream fix: https://github.com/libarchive/libarchive/commit/fd7e0c02
Other sources
The archivereadformatcpioreadheader function in archivereadsupportformatcpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4809?
CVE-2016-4809 does not have a high severity rating as it primarily leads to memory allocation failures causing crashes without further issues.
How do I fix CVE-2016-4809?
To fix CVE-2016-4809, upgrade to libarchive version 3.2.1 or later.
What type of vulnerability is CVE-2016-4809?
CVE-2016-4809 is a denial-of-service vulnerability due to handling overly large symlinks in cpio archives.
Which software is affected by CVE-2016-4809?
CVE-2016-4809 affects libarchive versions up to 3.2.0 and certain Red Hat Enterprise Linux and Oracle Linux versions.
Can CVE-2016-4809 lead to data loss?
No, CVE-2016-4809 mainly causes application crashes without leading to data loss.