Ubuntu 16.04 LTS USN-3033-1 Moderate: Libarchive Crash Risk and Update

ubuntu

July 14, 2016

libarchive could be made to crash or run programs if it opened a specially crafted file.

Summary

libarchive could be made to crash or run programs if it opened a specially

crafted file.

Software Description:

- libarchive: Library to read/write archive files

Details:

Hanno Böck discovered that libarchive contained multiple security issues

when processing certain malformed archive files. A remote attacker could

use this issue to cause libarchive to crash, resulting in a denial of

service, or possibly execute arbitrary code. (CVE-2015-8916, CVE-2015-8917

CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8922, CVE-2015-8923,

CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8930,

CVE-2015-8931, CVE-2015-8932, CVE-2015-8933, CVE-2015-8934, CVE-2016-5844)

Marcin "Icewall" Noga discovered that libarchive contained multiple

security issues when processing certain malformed archive files. A remote

attacker could use this issue to cause libarchive to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2016-430...

Read the Full Advisory

Topics Covered

security advisory denial of service Ubuntu moderate severity libarchive

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libarchive13                    3.1.2-11ubuntu0.16.04.2

Ubuntu 15.10:
  libarchive13                    3.1.2-11ubuntu0.15.10.2

Ubuntu 14.04 LTS:
  libarchive13                    3.1.2-7ubuntu2.3

Ubuntu 12.04 LTS:
  libarchive12                    3.0.3-6ubuntu1.3

In general, a standard system update will make all the necessary changes.