USN-3225-1: libarchive vulnerabilities

Ubuntu Security Notice USN-3225-1

9th March, 2017

libarchive vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10



• Ubuntu 16.04 LTS



• Ubuntu 14.04 LTS



• Ubuntu 12.04 LTS

Summary

libarchive could be made to crash, overwrite files, or run programs as your
login if it opened a specially crafted file.

Software description

• libarchive
  - Library to read/write archive files
  
  

Details

It was discovered that libarchive incorrectly handled hardlink entries when
extracting archives. A remote attacker could possibly use this issue to
overwrite arbitrary files. ()

Alexander Cherepanov discovered that libarchive incorrectly handled
recursive decompressions. A remote attacker could possibly use this issue
to cause libarchive to hang, resulting in a denial of service. This issue
only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
()

It was discovered that libarchive incorrectly handled line sizes when
extracting certain archives. A remote attacker could possibly use this
issue to cause libarchive to crash, resulting in a denial of service.
()

Jakub Jirasek discovered that libarchive incorrectly handled memory when
extracting certain archives. A remote attacker could possibly use this
issue to cause libarchive to crash, resulting in a denial of service.
(







.

In general, a standard system update will make all the necessary changes.

References

,

,

,

CVE-2017-5601