CVE-2016-4809

Published: 17 June 2016

The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
libarchive Launchpad, Ubuntu, Debian	Upstream	Needs triage




	Ubuntu 16.04 LTS (Xenial Xerus)	Released (3.1.2-11ubuntu0.16.04.2)
	Ubuntu 14.04 ESM (Trusty Tahr)	Released (3.1.2-7ubuntu2.3)
	Patches: Upstream: https://github.com/libarchive/libarchive/commit/fd7e0c02e272913a0a8b6d492c7260dfca0b1408

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4809
https://usn.ubuntu.com/usn/usn-3033-1
NVD
Launchpad
Debian

Bugs

https://github.com/libarchive/libarchive/issues/705

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM