CVE-2016-1541

Published: May 7, 2016Modified: May 6, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.

Affected (1)

Products: Libarchive: Libarchive

Libarchive

1 product

Libarchive

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libarchive Libarchive	Up to 3.1.901a

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (26)

http://lists.opensuse.org/opensuse-updates/2016-06/msg00003.html

Source: cret@cert.org

http://lists.opensuse.org/opensuse-updates/2016-06/msg00090.html

Source: cret@cert.org

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: cret@cert.org

http://www.debian.org/security/2016/dsa-3574

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/862384

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: cret@cert.org

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: cret@cert.org

http://www.securityfocus.com/bid/89355

Source: cret@cert.org

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.352685

Source: cret@cert.org

http://www.ubuntu.com/usn/USN-2981-1

Source: cret@cert.org

https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7

Source: cret@cert.org

https://github.com/libarchive/libarchive/issues/656

Source: cret@cert.org

https://security.gentoo.org/glsa/201701-03

Source: cret@cert.org

http://lists.opensuse.org/opensuse-updates/2016-06/msg00003.html