CVE-2016-7166: Medium severity red hat enterprise linux desktop vulnerability
A specially crafted gzip file can cause libarchive to allocate memory without limit, eventually leading to a crash.
External references: https://github.com/libarchive/libarchive/issues/660
Upstream fix: https://github.com/libarchive/libarchive/commit/6e06b1c89
Other sources
libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7166?
CVE-2016-7166 has been classified with high severity due to potential crashes caused by specially crafted gzip files.
How do I fix CVE-2016-7166?
To fix CVE-2016-7166, update libarchive to version 3.2.0 or later.
Which software is affected by CVE-2016-7166?
CVE-2016-7166 affects multiple versions of libarchive and various Red Hat Enterprise Linux distributions.
What kind of vulnerability is CVE-2016-7166?
CVE-2016-7166 is a memory allocation vulnerability that can lead to application crashes when processing malformed gzip files.
Can CVE-2016-7166 be exploited remotely?
Yes, CVE-2016-7166 can potentially be exploited remotely by sending carefully crafted gzip files.