CVE-2016-4809: Input Validation
First published: Thu Jun 16 2016(Updated: )
A cpio archive with a ridiculously large symlink can cause memory allocation to fail, resulting in any attempt to view or extract the archive crashing. The failed allocation appears to be handled correctly within libarchive and not lead to further issues. External references: <a href="https://github.com/libarchive/libarchive/issues/705">https://github.com/libarchive/libarchive/issues/705</a> Upstream fix: <a href="https://github.com/libarchive/libarchive/commit/fd7e0c02">https://github.com/libarchive/libarchive/commit/fd7e0c02</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/libarchive | <3.2.1 | 3.2.1 |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux HPC Node | =6.0 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux HPC Node | =7.0 | |
| Red Hat Enterprise Linux HPC Node | =7.2 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.2 | |
| Red Hat Enterprise Linux Server | =7.2 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| Oracle Linux | =6 | |
| Oracle Linux | =7 | |
| Oracle Libarchive | <=3.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/libarchive/libarchive/issues/705
- https://github.com/libarchive/libarchive/commit/fd7e0c02
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1352775
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1352776
- https://rhn.redhat.com/errata/RHSA-2016-1850.html
- https://rhn.redhat.com/errata/RHSA-2016-1844.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1347084
- http://rhn.redhat.com/errata/RHSA-2016-1844.html
- http://rhn.redhat.com/errata/RHSA-2016-1850.html
- http://www.debian.org/security/2016/dsa-3657
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/91813
- https://security.gentoo.org/glsa/201701-03
Frequently Asked Questions
What is the severity of CVE-2016-4809?
CVE-2016-4809 does not have a high severity rating as it primarily leads to memory allocation failures causing crashes without further issues.
How do I fix CVE-2016-4809?
To fix CVE-2016-4809, upgrade to libarchive version 3.2.1 or later.
What type of vulnerability is CVE-2016-4809?
CVE-2016-4809 is a denial-of-service vulnerability due to handling overly large symlinks in cpio archives.
Which software is affected by CVE-2016-4809?
CVE-2016-4809 affects libarchive versions up to 3.2.0 and certain Red Hat Enterprise Linux and Oracle Linux versions.
Can CVE-2016-4809 lead to data loss?
No, CVE-2016-4809 mainly causes application crashes without leading to data loss.
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-4809
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- package-manager/redhat
- vendor/redhat
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- canonical/red hat enterprise linux hpc node
- version/red hat enterprise linux hpc node/6.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux desktop/7.0
- version/red hat enterprise linux hpc node/7.0
- version/red hat enterprise linux hpc node/7.2
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.2
- version/red hat enterprise linux workstation/7.0
- vendor/oracle
- canonical/oracle linux
- version/oracle linux/6
- version/oracle linux/7
- vendor/libarchive
- canonical/oracle libarchive
- version/oracle libarchive/3.2.0