PublicDateAtUSN: 2017-02-15
Candidate: CVE-2016-8687
PublicDate: 2017-02-15 19:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8687
 https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-stack-based-buffer-overflow-in-bsdtar_expand_char-util-c/
 https://ubuntu.com/security/notices/USN-3225-1
Description:
 Stack-based buffer overflow in the safe_fprintf function in tar/util.c in
 libarchive 3.2.1 allows remote attackers to cause a denial of service via a
 crafted non-printable multibyte character in a filename.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840936
 https://github.com/libarchive/libarchive/issues/767
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_libarchive:
 upstream: https://github.com/libarchive/libarchive/commit/e37b620fe8f14535d737e89a4dcabaed4517bf1a
Tags_libarchive: stack-protector
upstream_libarchive: released (3.2.1-5)
precise_libarchive: released (3.0.3-6ubuntu1.4)
trusty_libarchive: released (3.1.2-7ubuntu2.4)
trusty/esm_libarchive: released (3.1.2-7ubuntu2.4)
vivid/stable-phone-overlay_libarchive: DNE
vivid/ubuntu-core_libarchive: DNE
xenial_libarchive: released (3.1.2-11ubuntu0.16.04.3)
esm-infra/xenial_libarchive: released (3.1.2-11ubuntu0.16.04.3)
yakkety_libarchive: released (3.2.1-2ubuntu0.1)
devel_libarchive: not-affected (3.2.1-6)