REDHAT-BUG-1672888: Medium severity oracle libarchive vulnerability

Published Feb 6, 2019

Updated

libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archivereadsupportformatiso9660.c, readCE()/parserockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.

References: https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423 https://github.com/libarchive/libarchive/pull/1120

Affected Software

1 affected component

Libarchive libarchive>=2.8.0

Event History

Feb 6, 2019

Data Sourced

via Red Hat·06:31 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1672888?

The severity of REDHAT-BUG-1672888 is categorized as a Denial of Service (DoS) vulnerability.

How do I fix REDHAT-BUG-1672888?

To fix REDHAT-BUG-1672888, you should upgrade to libarchive version 2.8.0 or later.

What is the cause of REDHAT-BUG-1672888?

REDHAT-BUG-1672888 is caused by an infinite loop vulnerability in the ISO9660 parser.

Which versions are affected by REDHAT-BUG-1672888?

Versions of libarchive prior to 2.8.0 are affected by REDHAT-BUG-1672888.

What type of vulnerability is REDHAT-BUG-1672888 classified as?

REDHAT-BUG-1672888 is classified as a CWE-835: Loop with Unreachable Exit Condition vulnerability.