Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.
Hanno Böck has disclosed another Undefined Behaviour (signed integer overflow) on oss-security:
http://seclists.org/oss-sec/2016/q2/591
Upstream ticket:
https://github.com/libarchive/libarchive/issues/717
Upstream fix (released in libarchive-3.2.1):
https://github.com/libarchive/libarchive/commit/3ad08e0
While the UB exists in 3.2.0, an earlier patch seems to mitigate against the issue:
https://github.com/libarchive/libarchive/commit/e6c9668f
This function is called immediately after the overflow, and will immediately reject a negative skipsize with ARCHIVEFATAL, skipping all further processing.
Previous releases up to and including 3.1.2 (including 2.8.3, 2.8.4) do not include the mitigation and are thus likely vulnerable.
Insomnia Security (as part of a pre-arranged commercial engagement) reports:
A vulnerability in libarchive exists that allows an archive Entry with type 1 (hardlink), but has a non-zero data size to cause a file overwrite. This vulnerability can be leveraged in a way that has a significant security impact (this was not clear at first during initial research by upstream).
A cpio archive with a ridiculously large symlink can cause memory allocation to fail, resulting in any attempt to view or extract the archive crashing. The failed allocation appears to be handled correctly within libarchive and not lead to further issues.
External references: https://github.com/libarchive/libarchive/issues/705
Upstream fix: https://github.com/libarchive/libarchive/commit/fd7e0c02
An exploitable heap overflow vulnerability exists in the 7zip readSubStreamsInfo functionality of libarchive. A specially crafted 7zip file can cause a integer overflow resulting in memory corruption that can lead to code execution. An attacker can send a malformed file to trigger this vulnerability.
External references:
http://www.talosintel.com/reports/TALOS-2016-0152/
Upstream fix:
https://github.com/libarchive/libarchive/commit/e79ef306afe332faf22e9b442a2c6b59cb175573
An exploitable stack based buffer overflow vulnerability exists in the mtree parsedevice functionality of libarchive. A specially crafted mtree file can cause a buffer overflow resulting in memory corruption/code execution. An attacker can send a malformed file to trigger this vulnerability.
External references:
http://www.talosintel.com/reports/TALOS-2016-0153/
Upstream fix:
https://github.com/libarchive/libarchive/commit/a550daeecf6bc689ade371349892ea17b5b97c77
Heap-based buffer overflow in the parsecodes function in archivereadsupportformatrar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.