PublicDateAtUSN: 2016-09-21
Candidate: CVE-2016-6250
PublicDate: 2016-09-21 14:25:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6250
 http://www.openwall.com/lists/oss-security/2016/07/20/1
 https://ubuntu.com/security/notices/USN-3225-1
Description:
 Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows
 remote attackers to cause a denial of service (application crash) or
 execute arbitrary code via vectors related to verifying filename lengths
 when writing an ISO9660 archive, which trigger a buffer overflow.
Ubuntu-Description:
Notes:
Bugs:
 https://github.com/libarchive/libarchive/issues/711
Priority: low
Discovered-by: Christian Wressnegger, Alwin Maier, and Fabian Yamaguchi
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H [8.6 HIGH]

Patches_libarchive:
 upstream: https://github.com/libarchive/libarchive/commit/3014e19820ea53c15c90f9d447ca3e668a0b76c6
upstream_libarchive: released (3.2.1-1)
precise_libarchive: released (3.0.3-6ubuntu1.4)
trusty_libarchive: released (3.1.2-7ubuntu2.4)
trusty/esm_libarchive: released (3.1.2-7ubuntu2.4)
vivid/stable-phone-overlay_libarchive: DNE
vivid/ubuntu-core_libarchive: DNE
wily_libarchive: ignored (reached end-of-life)
xenial_libarchive: released (3.1.2-11ubuntu0.16.04.3)
esm-infra/xenial_libarchive: released (3.1.2-11ubuntu0.16.04.3)
yakkety_libarchive: not-affected (3.2.1-1)
devel_libarchive: not-affected (3.2.1-1)