Updated libarchive packages fix security vulnerabilities
Publication date: 07 May 2017Modification date: 07 May 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-10209 , CVE-2016-10349 , CVE-2016-10350
Description
The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file. (CVE-2016-10209) The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. (CVE-2016-10349) The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. (CVE-2016-10350)
References
SRPMS
5/core
- libarchive-3.2.2-1.3.mga5