CVE-2016-4300

HIGH

libarchive < 3.2.1 - Remote Code Execution via 7zip Substream Count Overflow

Title source: llm
STIX 2.1

Description

Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.

References (12)

Core 12
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1844.html
Exploit, Third Party Advisory x_refsource_misc
http://blog.talosintel.com/2016/06/the-poisoned-archives.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91326
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/libarchive/libarchive/issues/718
Exploit, Third Party Advisory x_refsource_misc
http://www.talosintel.com/reports/TALOS-2016-0152/
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201701-03
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/libarchive/libarchive/commit/e79ef306afe332faf22e9b442a2c6b59cb175573
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3657
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1348439

Scores

CVSS v3 7.8
EPSS 0.0492
EPSS Percentile 91.0%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-190
Status published
Products (8)
libarchive/libarchive < 3.2.0
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_hpc_node 7.0
redhat/enterprise_linux_hpc_node_eus 7.2
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_server_aus 7.2
redhat/enterprise_linux_server_eus 7.2
redhat/enterprise_linux_workstation 7.0
Published Sep 21, 2016
Tracked Since Feb 18, 2026