Ubuntu 16.04 LTS USN-2981-1 Moderate: libarchive DoS Issue

ubuntu

May 17, 2016

libarchive could be made to crash or run programs if it opened a specially crafted file.

Summary

libarchive could be made to crash or run programs if it opened a specially

crafted file.

Software Description:

- libarchive: Library to read/write archive files

Details:

It was discovered that libarchive incorrectly handled certain entry-size

values in ZIP archives. A remote attacker could use this issue to cause

libarchive to crash, resulting in a denial of service, or possibly execute

arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10

and Ubuntu 16.04 LTS. (CVE-2016-1541)

It was discovered that libarchive incorrectly handled memory when

processing certain tar files. A remote attacker could use this issue to

cause libarchive to crash, resulting in a denial of service. (CVE number

pending)

Topics Covered

security advisory denial of service update instructions ubuntu libarchive

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libarchive13                    3.1.2-11ubuntu0.16.04.1

Ubuntu 15.10:
  libarchive13                    3.1.2-11ubuntu0.15.10.1

Ubuntu 14.04 LTS:
  libarchive13                    3.1.2-7ubuntu2.2

Ubuntu 12.04 LTS:
  libarchive12                    3.0.3-6ubuntu1.2

In general, a standard system update will make all the necessary changes.