CVE-2015-8921
High · 7.5CVSS
7.5
EPSS
12.0%
Published
Sep 20, 2016
CISA due date
—
The record
The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | libarchive | 0 | 3.2.0-2 |
| Debian:12 | libarchive | 0 | 3.2.0-2 |
| Debian:13 | libarchive | 0 | 3.2.0-2 |
| Debian:7 | libarchive | 0 | 3.0.4-3+wheezy2 |
| Debian:8 | libarchive | 0 | 3.1.2-11+deb8u2 |
| Red Hat:enterprise_linux:6::client | libarchive | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::client | libarchive-debuginfo | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::client | libarchive-devel | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::computenode | libarchive | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::computenode | libarchive-debuginfo | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::computenode | libarchive-devel | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::server | libarchive | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::server | libarchive-debuginfo | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::server | libarchive-devel | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::workstation | libarchive | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::workstation | libarchive-debuginfo | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:6::workstation | libarchive-devel | 0 | 0:2.8.3-7.el6_8 |
| Red Hat:enterprise_linux:7::client | bsdcpio | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::client | bsdtar | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::client | libarchive | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::client | libarchive-debuginfo | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::client | libarchive-devel | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::computenode | bsdcpio | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::computenode | bsdtar | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::computenode | libarchive | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::computenode | libarchive-debuginfo | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::computenode | libarchive-devel | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::server | bsdcpio | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::server | bsdtar | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::server | libarchive | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::server | libarchive-debuginfo | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::server | libarchive-devel | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::workstation | bsdcpio | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::workstation | bsdtar | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::workstation | libarchive | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::workstation | libarchive-debuginfo | 0 | 0:3.1.2-10.el7_2 |
| Red Hat:enterprise_linux:7::workstation | libarchive-devel | 0 | 0:3.1.2-10.el7_2 |
| SUSE:Linux Enterprise Desktop 12 SP1 | libarchive | 0 | 3.1.2-22.1 |
| SUSE:Linux Enterprise Point of Sale 11 SP3 | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Linux Enterprise Server 11 SP2-LTSS | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Linux Enterprise Server 11 SP3-LTSS | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Linux Enterprise Server 11 SP3-TERADATA | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Linux Enterprise Server 11 SP4 | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Linux Enterprise Server 12 SP1 | libarchive | 0 | 3.1.2-22.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | libarchive | 0 | 3.1.2-22.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | libarchive | 0 | 3.1.2-22.1 |
| SUSE:Manager 2.1 | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Manager Proxy 2.1 | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:OpenStack Cloud 5 | bsdtar | 0 | 2.5.5-9.1 |
| SUSE:Studio Onsite 1.3 | bsdtar | 0 | 2.5.5-9.1 |
| Ubuntu:14.04:LTS | libarchive | 0 | 3.1.2-7ubuntu2.3 |
| Ubuntu:16.04:LTS | libarchive | 0 | 3.1.2-11ubuntu0.16.04.2 |
Related vulnerabilities
- JLSEC-2025-250 libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in… Also affects libarchive
- CVE-2024-57970 libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in… Also affects libarchive
- CVE-2024-20696 Windows Libarchive Remote Code Execution Vulnerability Also affects libarchive
- CVE-2017-14502 read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an… Also affects libarchive
- CVE-2016-10209 The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2… Also affects libarchive
- CVE-2016-5418 The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries… Also affects libarchive
- CVE-2015-8916 bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when… Also affects libarchive
- CVE-2016-1541 Heap-based buffer overflow in the zip_read_mac_metadata function in… Also affects libarchive