CVE-2017-14503: Medium severity Libarchive libarchive vulnerability
Last updated 25 August 2025
Other sources
libarchive 3.3.2 suffers from an out-of-bounds read within lhareaddatanone() in archivereadsupportformatlha.c when extracting a specially crafted lha archive, related to lhacrc16.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libarchiveto a version that resolves this vulnerability.Fixed in 3.3.3 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.6.2-1+deb12u4Fixed in 3.6.2-1+deb12u5Fixed in 3.7.4-4+deb13u1Fixed in 3.8.10-2Fixed in 3.8.11-1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14503?
CVE-2017-14503 is classified as a high severity vulnerability due to its potential for exploitation via specially crafted lha archives.
How do I fix CVE-2017-14503?
To mitigate CVE-2017-14503, upgrade libarchive to version 3.3.3 or later on affected distributions.
What software is affected by CVE-2017-14503?
CVE-2017-14503 affects libarchive version 3.3.2 and earlier versions.
What type of vulnerability is CVE-2017-14503?
CVE-2017-14503 is an out-of-bounds read vulnerability that occurs during the extraction of crafted lha archives.
Can CVE-2017-14503 be exploited remotely?
Yes, CVE-2017-14503 could potentially be exploited remotely if a user extracts a malicious lha archive.