CVE-2016-7166

CWE-399CWE-770 — Allocation without Limits10 documents9 sources
Severity
5.5MEDIUM
EPSS
0.4%
top 41.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Libarchive LibarchiveOracle LinuxRedhat Enterprise Linux Desktop+6 more
Timeline
PublishedSep 21
Latest updateMay 13

Description

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages7 packages

▶Debianlibarchive< 3.2.0-2+3
▶NVDlibarchive/libarchive3.1.901a
▶NVDoracle/linux6, 7+1

Also affects: Enterprise Linux 7.2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-8hwj-j49v-pfwp: libarchive before 3↗2022-05-13
▶
CVEList
CVE-2016-7166: libarchive before 3↗2016-09-21
▶
OSV
CVE-2016-7166: libarchive before 3↗2016-09-21
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Office PowerPoint 2010 - Invalid Pointer Reference↗2016-09-21
▶

📋Vendor Advisories

3
Ubuntu
libarchive vulnerabilities↗2017-03-09
▶
Red Hat
libarchive: Denial of service using a crafted gzip file↗2016-02-22
▶
Debian
CVE-2016-7166: libarchive - libarchive before 3.2.0 does not limit the number of recursive decompressions, w...↗2016
▶

💬Community

2
Bugzilla
CVE-2015-8920 CVE-2015-8921 CVE-2015-8932 CVE-2015-8933 CVE-2016-4809 CVE-2016-5844 CVE-2016-7166 libarchive: various flaws [epel-5]↗2016-07-05
▶
Bugzilla
CVE-2016-7166 libarchive: Denial of service using a crafted gzip file↗2016-06-16
▶
CVE-2016-7166 (MEDIUM CVSS 5.5) | libarchive before 3.2.0 does not li | cvebase.io