CVE-2016-8687: Buffer Overflow
libarchive. A buffer overflow issue was addressed through improved memory handling.
Other sources
Miscalculations in the safefprintf() function meant that the buffer allocated for decoding could be overflowed by crafted Unicode filenames.
Disclosed on oss-security:
http://seclists.org/oss-sec/2016/q3/516
Upstream issue:
https://github.com/libarchive/libarchive/issues/767
Upstream fix:
https://github.com/libarchive/libarchive/commit/e37b620f
— Red Hat
Stack-based buffer overflow in the safefprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
— MITRE
Credit
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2016-8687?
CVE-2016-8687 is classified as a moderate severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2016-8687?
To resolve CVE-2016-8687, upgrade to libarchive version 3.2.2 or higher, or update affected Apple iOS systems beyond version 10.2.1.
What type of vulnerability is CVE-2016-8687?
CVE-2016-8687 is a buffer overflow vulnerability triggered by crafted non-printable multibyte characters in filenames.
Who is affected by CVE-2016-8687?
CVE-2016-8687 affects libarchive versions up to and including 3.2.1, and iOS versions up to and including 10.2.1.
What impact can CVE-2016-8687 have on systems?
CVE-2016-8687 can lead to a denial of service, potentially disrupting services for users.