CVE-2015-8927 — Out-of-bounds Read in Libarchive

CWE-125 — Out-of-bounds ReadCWE-228 — Improper Handling of Syntactically Invalid Structure6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.2%
top 55.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
LibarchiveDebian Libarchive
Timeline
PublishedSep 20
Latest updateMay 17

Description

The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/libarchive< libarchive 3.2.0-2 (bookworm)
▶Debianlibarchive/libarchive< 3.2.0-2+3
▶NVDlibarchive/libarchive3.1.901a

🔴Vulnerability Details

2
GHSA
GHSA-m6f6-xrcp-8vjq: The trad_enc_decrypt_update function in archive_read_support_format_zip↗2022-05-17
▶
OSV
CVE-2015-8927: The trad_enc_decrypt_update function in archive_read_support_format_zip↗2016-09-20
▶

📋Vendor Advisories

2
Red Hat
libarchive: Heap out of bounds read when reading password for malformed ZIP↗2016-06-17
▶
Debian
CVE-2015-8927: libarchive - The trad_enc_decrypt_update function in archive_read_support_format_zip.c in lib...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-8927 libarchive: Heap out of bounds read when reading password for malformed ZIP↗2016-06-21
▶