CVE-2016-5844: Integer Overflow
Hanno Böck has disclosed another Undefined Behaviour (signed integer overflow) on oss-security:
http://seclists.org/oss-sec/2016/q2/591
Upstream ticket:
https://github.com/libarchive/libarchive/issues/717
Upstream fix (released in libarchive-3.2.1):
https://github.com/libarchive/libarchive/commit/3ad08e0
While the UB exists in 3.2.0, an earlier patch seems to mitigate against the issue:
https://github.com/libarchive/libarchive/commit/e6c9668f
This function is called immediately after the overflow, and will immediately reject a negative skipsize with ARCHIVEFATAL, skipping all further processing.
Previous releases up to and including 3.1.2 (including 2.8.3, 2.8.4) do not include the mitigation and are thus likely vulnerable.
Other sources
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5844?
CVE-2016-5844 is classified as a high severity vulnerability due to the potential for exploitation through signed integer overflow.
How do I fix CVE-2016-5844?
To mitigate CVE-2016-5844, update to libarchive version 3.2.1 or later.
What software is affected by CVE-2016-5844?
CVE-2016-5844 affects libarchive versions prior to 3.2.1.
Can CVE-2016-5844 impact all versions of Red Hat Enterprise Linux?
Yes, CVE-2016-5844 can impact Red Hat Enterprise Linux version 6.0 and 7.0 as well as specific applications built on older versions of libarchive.
Is there an exploit available for CVE-2016-5844?
As of now, public details about an exploit specifically targeting CVE-2016-5844 have not been disclosed.