Advisories ยป MGASA-2017-0132

Updated libarchive packages fix security vulnerabilities

Publication date: 07 May 2017
Modification date: 07 May 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-10209 , CVE-2016-10349 , CVE-2016-10350

Description

The archive_wstring_append_from_mbs function in archive_string.c in
libarchive 3.2.2 allows remote attackers to cause a denial of service
(NULL pointer dereference and application crash) via a crafted archive
file. (CVE-2016-10209)

The archive_le32dec function in archive_endian.h in libarchive 3.2.2
allows remote attackers to cause a denial of service (heap-based buffer
over-read and application crash) via a crafted file. (CVE-2016-10349)

The archive_read_format_cab_read_header function in
archive_read_support_format_cab.c in libarchive 3.2.2 allows remote
attackers to cause a denial of service (heap-based buffer over-read and
application crash) via a crafted file. (CVE-2016-10350)
                

References

SRPMS

5/core