CVE-2017-14501

Reference Links

• https://bugs.debian.org/875966
• https://github.com/libarchive/libarchive/issues/949
• https://usn.ubuntu.com/3736-1/
• https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
• https://www.debian.org/security/2018/dsa-4360
• https://security.gentoo.org/glsa/201908-11
• https://launchpad.net/bugs/cve/CVE-2017-14501
• https://github.com/libarchive/libarchive/commit/f9569c086ff29259c73790db9cbf39fe8fb9d862
• https://security-tracker.debian.org/tracker/CVE-2017-14501
• https://ubuntu.com/security/notices/USN-3736-1
• https://www.cve.org/CVERecord?id=CVE-2017-14501
• https://nvd.nist.gov/vuln/detail/CVE-2017-14501
• https://github.com/mmatuska/libarchive/commit/13e87dcd9c37b533127cceb9f3e1e5a38d95e784
• https://ubuntu.com/security/CVE-2017-14501

Parent vulnerabilities

(Appears in the following advisories)

• USN-3736-1

Frequently Asked Questions

• What is the severity of CVE-2017-14501?

  CVE-2017-14501 is classified as a high-severity vulnerability due to its potential to allow an attacker to exploit out-of-bounds read flaws.

• How do I fix CVE-2017-14501?

  To fix CVE-2017-14501, upgrade the libarchive package to versions 3.2.2-3.1ubuntu0.1 or later for Ubuntu or install the corresponding patched version for Debian.

• What impact does CVE-2017-14501 have on systems?

  CVE-2017-14501 can lead to information disclosure and could be exploited by an attacker to read parts of memory that should remain confidential.

• Which versions of libarchive are affected by CVE-2017-14501?

  Versions of libarchive prior to 3.3.2 are affected by CVE-2017-14501 if they are used in the context of handling specially crafted ISO9660 files.

• Is my system vulnerable to CVE-2017-14501?

  You may be vulnerable to CVE-2017-14501 if you are running affected versions of libarchive on your system without the appropriate patches.