CVE-2016-8687
published 2017-02-15CVE-2016-8687: Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted…
PriorityP339high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
1.38%
80.6th percentile
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | macos_sierra | — | — |
| apple | tvos | — | — |
| apple | watchos | — | — |
| debian | libarchive | < libarchive 3.2.1-5 (bookworm) | libarchive 3.2.1-5 (bookworm) |
| libarchive | libarchive | — | — |
| libarchive | libarchive | >= 0 < 3.2.1-5 | 3.2.1-5 |
| libarchive | libarchive | >= 0 < 3.2.1-5 | 3.2.1-5 |
| libarchive | libarchive | >= 0 < 3.2.1-5 | 3.2.1-5 |
| libarchive | libarchive | >= 0 < 3.2.1-5 | 3.2.1-5 |
| libarchive | libarchive | >= 0 < 3.1.2-7ubuntu2.4 | 3.1.2-7ubuntu2.4 |
| libarchive | libarchive | >= 0 < 3.1.2-11ubuntu0.16.04.3 | 3.1.2-11ubuntu0.16.04.3 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
Ubuntu
libarchive vulnerabilities
vendor_ubuntu·2017-03-09·CVSS 7.5
CVE-2016-5418 [HIGH] libarchive vulnerabilities
Title: libarchive vulnerabilities
Summary: libarchive could be made to crash, overwrite files, or run programs as your
login if it opened a specially crafted file.
It was discovered that libarchive incorrectly handled hardlink entries when
extracting archives. A remote attacker could possibly use this issue to
overwrite arbitrary files. (CVE-2016-5418)
Christian Wressnegger, Alwin Maier, and Fabian Yamaguchi discovered that
libarchive incorrectly handled filename lengths when writing ISO9660
archives. A remote attacker could use this issue to cause libarchive to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and
Ubuntu 16.04 LTS. (CVE-2016-6250)
Alexander Cherepanov discovered that libarchive in
Apple
CVE-2016-8687: iOS 10.2.1
vendor_apple·2017-01-23·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687: iOS 10.2.1
Apple Security Update: About the security content of iOS 10.2.1
Product: iOS
Version: 10.2.1
CVE: CVE-2016-8687
Component: Kernel
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A use after free issue was addressed through improved memory management.
Apple
CVE-2016-8687: tvOS 10.1.1
vendor_apple·2017-01-23·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687: tvOS 10.1.1
Apple Security Update: About the security content of tvOS 10.1.1
Product: tvOS
Version: 10.1.1
CVE: CVE-2016-8687
Component: Kernel
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A use after free issue was addressed through improved memory management.
Apple
CVE-2016-8687: macOS Sierra 10.12.3
vendor_apple·2017-01-23·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687: macOS Sierra 10.12.3
Apple Security Update: About the security content of macOS Sierra 10.12.3
Product: macOS Sierra
Version: 10.12.3
CVE: CVE-2016-8687
Component: Kernel
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A use after free issue was addressed through improved memory management.
Apple
CVE-2016-8687: watchOS 3.1.3
vendor_apple·2017-01-23·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687: watchOS 3.1.3
Apple Security Update: About the security content of watchOS 3.1.3
Product: watchOS
Version: 3.1.3
CVE: CVE-2016-8687
Component: Kernel
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A use after free issue was addressed through improved memory management.
Red Hat
libarchive: stack based buffer overflow in bsdtar_expand_char (util.c)
vendor_redhat·2016-09-15·CVSS 7.5
CVE-2016-8687 [HIGH] CWE-131 libarchive: stack based buffer overflow in bsdtar_expand_char (util.c)
libarchive: stack based buffer overflow in bsdtar_expand_char (util.c)
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: libarchive (Red Hat Enterprise Linux 6) - Not affected
Package: libarchive (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2016-8687: libarchive - Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarc...
vendor_debian·2016·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687: libarchive - Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarc...
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
Scope: local
bookworm: resolved (fixed in 3.2.1-5)
bullseye: resolved (fixed in 3.2.1-5)
forky: resolved (fixed in 3.2.1-5)
sid: resolved (fixed in 3.2.1-5)
trixie: resolved (fixed in 3.2.1-5)
GHSA
GHSA-c42q-jv3x-rq38: Stack-based buffer overflow in the safe_fprintf function in tar/util
ghsa_unreviewed·2022-05-14
CVE-2016-8687 [HIGH] CWE-119 GHSA-c42q-jv3x-rq38: Stack-based buffer overflow in the safe_fprintf function in tar/util
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
OSV
libarchive vulnerabilities
osv·2017-03-09·CVSS 7.5
CVE-2016-5418 [HIGH] libarchive vulnerabilities
libarchive vulnerabilities
It was discovered that libarchive incorrectly handled hardlink entries when
extracting archives. A remote attacker could possibly use this issue to
overwrite arbitrary files. (CVE-2016-5418)
Christian Wressnegger, Alwin Maier, and Fabian Yamaguchi discovered that
libarchive incorrectly handled filename lengths when writing ISO9660
archives. A remote attacker could use this issue to cause libarchive to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and
Ubuntu 16.04 LTS. (CVE-2016-6250)
Alexander Cherepanov discovered that libarchive incorrectly handled
recursive decompressions. A remote attacker could possibly use this issue
to cause libarchive to hang, resulting in a de
OSV
CVE-2016-8687: Stack-based buffer overflow in the safe_fprintf function in tar/util
osv·2017-02-15·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687: Stack-based buffer overflow in the safe_fprintf function in tar/util
Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 libarchive: various flaws [epel-5]
bugzilla·2016-10-17·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 libarchive: various flaws [epel-5]
CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 libarchive: various flaws [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Bugzilla
libarchive: various flaws [fedora-all]
bugzilla·2016-10-17·CVSS 7.5
[HIGH] libarchive: various flaws [fedora-all]
libarchive: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has
Bugzilla
CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 libarchive3: various flaws [epel-6]
bugzilla·2016-10-17·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 libarchive3: various flaws [epel-6]
CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 libarchive3: various flaws [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-tracking-bugs]
Bugzilla
CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 mingw-libarchive: various flaws [fedora-all]
bugzilla·2016-10-17·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 mingw-libarchive: various flaws [fedora-all]
CVE-2016-8687 CVE-2016-8688 CVE-2016-8689 mingw-libarchive: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
Bugzilla
CVE-2016-8687 libarchive: stack based buffer overflow in bsdtar_expand_char (util.c) [fedora-all]
bugzilla·2016-09-23·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687 libarchive: stack based buffer overflow in bsdtar_expand_char (util.c) [fedora-all]
CVE-2016-8687 libarchive: stack based buffer overflow in bsdtar_expand_char (util.c) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple su
Bugzilla
CVE-2016-8687 libarchive: stack based buffer overflow in bsdtar_expand_char (util.c)
bugzilla·2016-09-21·CVSS 7.5
CVE-2016-8687 [HIGH] CVE-2016-8687 libarchive: stack based buffer overflow in bsdtar_expand_char (util.c)
CVE-2016-8687 libarchive: stack based buffer overflow in bsdtar_expand_char (util.c)
Miscalculations in the safe_fprintf() function meant that the
buffer allocated for decoding could be overflowed by crafted
Unicode filenames.
Disclosed on oss-security:
http://seclists.org/oss-sec/2016/q3/516
Upstream issue:
https://github.com/libarchive/libarchive/issues/767
Upstream fix:
https://github.com/libarchive/libarchive/commit/e37b620f
Discussion:
This only affects the bsdtar utility, libraries and applications linked against libarchive are not affected by this flaw.
Compiling with -fstack-protector-strong (as is the case in RHEL & Fedora) mitigates any code execution vector here. In any case, the overflowed bytes are limited to ASCII octal escapes so even without these protections an a
http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.htmlhttp://www.openwall.com/lists/oss-security/2016/10/16/11http://www.securityfocus.com/bid/93781http://www.securitytracker.com/id/1037668https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-stack-based-buffer-overflow-in-bsdtar_expand_char-util-c/https://bugzilla.redhat.com/show_bug.cgi?id=1377926https://github.com/libarchive/libarchive/commit/e37b620fe8f14535d737e89a4dcabaed4517bf1ahttps://lists.debian.org/debian-lts-announce/2018/11/msg00037.htmlhttps://security.gentoo.org/glsa/201701-03http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.htmlhttp://www.openwall.com/lists/oss-security/2016/10/16/11http://www.securityfocus.com/bid/93781http://www.securitytracker.com/id/1037668https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-stack-based-buffer-overflow-in-bsdtar_expand_char-util-c/https://bugzilla.redhat.com/show_bug.cgi?id=1377926https://github.com/libarchive/libarchive/commit/e37b620fe8f14535d737e89a4dcabaed4517bf1ahttps://lists.debian.org/debian-lts-announce/2018/11/msg00037.htmlhttps://security.gentoo.org/glsa/201701-03
2017-02-15
Published