Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Ubuntu 14.04 LTS: USN-2549-1 Moderate: libarchive Crash and Overwrite

ubuntu
Calendar Grey March 25, 2015
Dist Ubuntu Esm H88
Ubuntu security advisory regarding libarchive flaws leading to system instabilities and data loss across multiple versions.
libarchive could be made to crash or overwrite files.

Summary

libarchive could be made to crash or overwrite files.

Software Description:

- libarchive: Library to read/write archive files

Details:

It was discovered that the libarchive bsdcpio utility extracted absolute

paths by default without using the --insecure flag, contrary to

expectations. If a user or automated system were tricked into extracting

cpio archives containing absolute paths, a remote attacker may be able to

write to arbitrary files. (CVE-2015-2304)

Fabian Yamaguchi discovered that libarchive incorrectly handled certain

type conversions. A remote attacker could possibly use this issue to cause

libarchive to crash, resulting in a denial of service. This issue only

affected Ubuntu 12.04 LTS. (CVE-2013-0211)

Topics%20covered

Topics Covered

security advisory file overwrite Ubuntu moderate severity crash issue libarchive bsdcpio

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  bsdcpio                         3.1.2-9ubuntu0.1
  libarchive13                    3.1.2-9ubuntu0.1

Ubuntu 14.04 LTS:
  bsdcpio                         3.1.2-7ubuntu2.1
  libarchive13                    3.1.2-7ubuntu2.1

Ubuntu 12.04 LTS:
  bsdcpio                         3.0.3-6ubuntu1.1
  libarchive12                    3.0.3-6ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2549-1

CVE-2013-0211, CVE-2015-2304

Severity
important
Lowest
Low
Medium
High
Critical

March 25, 2015

Topics%20covered

Topics Covered

security advisory file overwrite Ubuntu moderate severity crash issue libarchive bsdcpio

Package Information

https://launchpad.net/ubuntu/+source/libarchive/3.1.2-9ubuntu0.1
https://launchpad.net/ubuntu/+source/libarchive/3.1.2-7ubuntu2.1
https://launchpad.net/ubuntu/+source/libarchive/3.0.3-6ubuntu1.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.