Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurpcentraldirectory in archivereadsupportformatzip.c.

Heap-based buffer overflow in the zipreadmacmetadata function in archivereadsupportformatzip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.

An exploitable heap overflow vulnerability exists in the 7zip readSubStreamsInfo functionality of libarchive. A specially crafted 7zip file can cause a integer overflow resulting in memory corruption that can lead to code execution. An attacker can send a malformed file to trigger this vulnerability.

External references:

http://www.talosintel.com/reports/TALOS-2016-0152/

Upstream fix:

https://github.com/libarchive/libarchive/commit/e79ef306afe332faf22e9b442a2c6b59cb175573

An exploitable stack based buffer overflow vulnerability exists in the mtree parsedevice functionality of libarchive. A specially crafted mtree file can cause a buffer overflow resulting in memory corruption/code execution. An attacker can send a malformed file to trigger this vulnerability.

External references:

http://www.talosintel.com/reports/TALOS-2016-0153/

Upstream fix:

https://github.com/libarchive/libarchive/commit/a550daeecf6bc689ade371349892ea17b5b97c77

Multiple integer overflows in the (1) gettimetmax and (2) gettimetmin functions in archivereadsupportformatmtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.

Heap-based buffer overflow in the parsecodes function in archivereadsupportformatrar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.

The aestrtofflags function in archiveentry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.

The archivestringappend function in archivestring.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy."

The lhareadfileextendedheader function in archivereadsupportformatlha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file.

Insomnia Security (as part of a pre-arranged commercial engagement) reports:

A vulnerability in libarchive exists that allows an archive Entry with type 1 (hardlink), but has a non-zero data size to cause a file overwrite. This vulnerability can be leveraged in a way that has a significant security impact (this was not clear at first during initial research by upstream).

A cpio archive with a ridiculously large symlink can cause memory allocation to fail, resulting in any attempt to view or extract the archive crashing. The failed allocation appears to be handled correctly within libarchive and not lead to further issues.

External references: https://github.com/libarchive/libarchive/issues/705

Upstream fix: https://github.com/libarchive/libarchive/commit/fd7e0c02

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.

bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.

The processextra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.

Hanno Böck has disclosed another Undefined Behaviour (signed integer overflow) on oss-security:

http://seclists.org/oss-sec/2016/q2/591

Upstream ticket:

https://github.com/libarchive/libarchive/issues/717

Upstream fix (released in libarchive-3.2.1):

https://github.com/libarchive/libarchive/commit/3ad08e0

While the UB exists in 3.2.0, an earlier patch seems to mitigate against the issue:

https://github.com/libarchive/libarchive/commit/e6c9668f

This function is called immediately after the overflow, and will immediately reject a negative skipsize with ARCHIVEFATAL, skipping all further processing.

Previous releases up to and including 3.1.2 (including 2.8.3, 2.8.4) do not include the mitigation and are thus likely vulnerable.

bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.

Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.

The arreadheader function in archivereadsupportformatar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.

The archivereadformattarreadheader function in archivereadsupportformattar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.

The readCodersInfo function in archivereadsupportformat7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the 7zfolder struct.

A memory leak in archivereadformatzipcleanup in archivereadsupportformatzip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVELZMAH typo. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.

A specially crafted gzip file can cause libarchive to allocate memory without limit, eventually leading to a crash.

External references: https://github.com/libarchive/libarchive/issues/660

Upstream fix: https://github.com/libarchive/libarchive/commit/6e06b1c89

The readline function in archivereadsupportformatmtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.

The archivereadformatrarreaddata function in archivereadsupportformatrar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.

The processaddentry function in archivereadsupportformatmtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.

The tradencdecryptupdate function in archivereadsupportformatzip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password.

Memory leak in the archivereadgetextract function in archivereadextract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.

Integer overflow in the archivereadformattarskip function in archivereadsupportformattar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.

bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.