PublicDateAtUSN: 2017-02-15
Candidate: CVE-2016-8689
PublicDate: 2017-02-15 19:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8689
 https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-heap-based-buffer-overflow-in-read_header-archive_read_support_format_7zip-c/
 https://ubuntu.com/security/notices/USN-3225-1
Description:
 The read_Header function in archive_read_support_format_7zip.c in
 libarchive 3.2.1 allows remote attackers to cause a denial of service
 (out-of-bounds read) via multiple EmptyStream attributes in a header in a
 7zip archive.
Ubuntu-Description:
Notes:
Bugs:
 https://github.com/libarchive/libarchive/issues/761
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840934
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_libarchive:
 upstream: https://github.com/libarchive/libarchive/commit/7f17c791dcfd8c0416e2cd2485b19410e47ef126
upstream_libarchive: released (3.2.1-5)
precise_libarchive: released (3.0.3-6ubuntu1.4)
trusty_libarchive: released (3.1.2-7ubuntu2.4)
trusty/esm_libarchive: released (3.1.2-7ubuntu2.4)
vivid/stable-phone-overlay_libarchive: DNE
vivid/ubuntu-core_libarchive: DNE
xenial_libarchive: released (3.1.2-11ubuntu0.16.04.3)
esm-infra/xenial_libarchive: released (3.1.2-11ubuntu0.16.04.3)
yakkety_libarchive: released (3.2.1-2ubuntu0.1)
devel_libarchive: not-affected (3.2.1-6)