CVE-2017-14502: Buffer Overflow

Reference Links

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=573
• https://bugs.debian.org/875974
• https://github.com/libarchive/libarchive/commit/5562545b5562f6d12a4ef991fae158bf4ccf92b6
• https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
• https://www.debian.org/security/2018/dsa-4360
• https://usn.ubuntu.com/3859-1/
• https://security.gentoo.org/glsa/201908-11
• https://launchpad.net/bugs/cve/CVE-2017-14502
• https://exchange.xforce.ibmcloud.com/vulnerabilities/132123
• https://www.ibm.com/support/pages/node/6493729 (Advisory)
• https://security-tracker.debian.org/tracker/CVE-2017-14502
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14502
• https://nvd.nist.gov/vuln/detail/CVE-2017-14502
• https://ubuntu.com/security/CVE-2017-14502

Parent vulnerabilities

(Appears in the following advisories)

• IBM-6493729

Frequently Asked Questions

• What is CVE-2017-14502?

  CVE-2017-14502 is a vulnerability in libarchive 3.3.2 that allows a remote attacker to execute arbitrary code on the system by exploiting a buffer overflow in the read_header function in archive_read_support_format_rar.c.

• How does CVE-2017-14502 impact libarchive?

  CVE-2017-14502 can lead to a buffer overflow in libarchive, potentially allowing an attacker to execute arbitrary code on the system.

• Which versions of libarchive are affected by CVE-2017-14502?

  CVE-2017-14502 affects libarchive version 3.3.2.

• What is the severity of CVE-2017-14502?

  CVE-2017-14502 has a severity rating of 7.8 (High).

• How can I fix CVE-2017-14502 in libarchive?

  To fix CVE-2017-14502 in libarchive, it is recommended to update to a version that includes the fix, such as version 3.3.3 or later.