CVE-2015-8931

Published: Sep 20, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.

Affected (10)

Products: Libarchive: Libarchive · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit · Canonical: Ubuntu Linux · +1 more

Show all products

Libarchive: Libarchive · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libarchive Libarchive	Up to 3.1.901a

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Desktop	Version 12 sp1
Suse Linux Enterprise Server	Version 12 sp1
Suse Linux Enterprise Software Development Kit	Version 12 sp1

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Related CWEs

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (24)

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3657

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/06/17/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/17/5

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/91338

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-3033-1

Source: cve@mitre.org

Third Party Advisory

https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/libarchive/libarchive/issues/539

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2015-8931

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://security.gentoo.org/glsa/201701-03

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2016/dsa-3657

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/06/17/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/17/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/91338

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-3033-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/libarchive/libarchive/issues/539

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2015-8931

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://security.gentoo.org/glsa/201701-03

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.