CVE-2016-8688: Medium severity Libarchive libarchive vulnerability
Bookkeeping errors when extending the read-ahead buffer when trying to identify an mtree archive could lead libarchive to significantly overcalculate the size of the line being read, resulting in heap out-of-bounds reads or a crash.
Disclosed on oss-security:
http://seclists.org/oss-sec/2016/q3/516
Upstream issue:
https://github.com/libarchive/libarchive/issues/747
Upstream fix:
https://github.com/libarchive/libarchive/commit/eec077f
All the mtree-related crashes in the oss-sec post came from the same underlying issue and were resolved in this commit.
Other sources
The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detectform or (2) bidentry function in libarchive/archivereadsupportformatmtree.c.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8688?
CVE-2016-8688 is classified as a medium severity vulnerability due to potential heap out-of-bounds reads or crashes.
How do I fix CVE-2016-8688?
To mitigate CVE-2016-8688, upgrade libarchive to version 3.2.2 or later.
What are the affected versions for CVE-2016-8688?
CVE-2016-8688 affects libarchive versions prior to 3.2.2, notably version 3.2.1.
Can CVE-2016-8688 lead to data loss?
Yes, CVE-2016-8688 may result in crashes that could lead to data loss in affected applications.
Which operating systems are vulnerable to CVE-2016-8688?
CVE-2016-8688 has been found in versions of libarchive used by various Linux distributions, including openSUSE.