CVE-2015-8923

CWE-20 — Improper Input ValidationCWE-190 — Integer OverflowCWE-125 — Out-of-bounds Read11 documents8 sources
Severity
6.5MEDIUM
EPSS
2.6%
top 14.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Libarchive LibarchiveCanonical Ubuntu LinuxNovell Suse Linux Enterprise Desktop+2 more
Timeline
PublishedSep 20
Latest updateMay 14

Description

The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶Debianlibarchive< 3.2.0-2+3
▶Ubuntulibarchive< 3.1.2-7ubuntu2.3+1
▶NVDlibarchive/libarchive3.1.901a

Also affects: Ubuntu Linux 12.04, 14.04, 15.10, 16.04

🔴Vulnerability Details

6
GHSA
GHSA-h5p5-pgmm-q97w: The process_extra function in libarchive before 3↗2022-05-14
▶
OSV
php7.2, php7.4 vulnerabilities↗2022-03-03
▶
OSV
php7.0 vulnerabilities↗2022-02-22
▶
CVEList
CVE-2015-8923: The process_extra function in libarchive before 3↗2016-09-20
▶
OSV
CVE-2015-8923: The process_extra function in libarchive before 3↗2016-09-20
▶

📋Vendor Advisories

3
Ubuntu
libarchive vulnerabilities↗2016-07-14
▶
Red Hat
libarchive: Unclear crashes in ZIP parser↗2016-06-17
▶
Debian
CVE-2015-8923: libarchive - The process_extra function in libarchive before 3.2.0 uses the size field and a ...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-8923 libarchive: Unclear crashes in ZIP parser↗2016-06-22
▶