CVE-2017-14503: Medium severity Libarchive libarchive vulnerability
Published Sep 17, 2017
·Updated
Last updated 25 August 2025
Other sources
libarchive 3.3.2 suffers from an out-of-bounds read within lhareaddatanone() in archivereadsupportformatlha.c when extracting a specially crafted lha archive, related to lhacrc16.
— Launchpad
Affected Software
3 affected componentsFixes available
redhat/libarchive<3.3.3
3.3.3
Libarchive libarchive=3.3.2
debian/libarchive
3.4.3-2+deb11u13.4.3-2+deb11u33.6.2-1+deb12u33.6.2-1+deb12u23.7.4-43.8.5-1
Remediation
Event History
Sep 17, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:29 PM
DescriptionSeverityWeaknessAffected Software
Aug 5, 2024
Data Sourced
via Launchpad·07:27 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·03:54 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·03:55 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-14503?
CVE-2017-14503 is classified as a high severity vulnerability due to its potential for exploitation via specially crafted lha archives.
2
How do I fix CVE-2017-14503?
To mitigate CVE-2017-14503, upgrade libarchive to version 3.3.3 or later on affected distributions.
3
What software is affected by CVE-2017-14503?
CVE-2017-14503 affects libarchive version 3.3.2 and earlier versions.
4
What type of vulnerability is CVE-2017-14503?
CVE-2017-14503 is an out-of-bounds read vulnerability that occurs during the extraction of crafted lha archives.
5
Can CVE-2017-14503 be exploited remotely?
Yes, CVE-2017-14503 could potentially be exploited remotely if a user extracts a malicious lha archive.