CVE-2016-4302

Published: Sep 21, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.

Affected (8)

Products: Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Hpc Node Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation · Libarchive: Libarchive

7 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Workstation	Version 7.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Libarchive Libarchive	Up to 3.2.0

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (22)

http://blog.talosintel.com/2016/06/the-poisoned-archives.html

Source: cret@cert.org

ExploitThird Party Advisory

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1348444

Source: cret@cert.org

Issue Tracking

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: cret@cert.org

Third Party Advisory

http://www.debian.org/security/2016/dsa-3657

Source: cret@cert.org

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: cret@cert.org

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: cret@cert.org

http://www.securityfocus.com/bid/91331

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.talosintel.com/reports/TALOS-2016-0154/

Source: cret@cert.org

ExploitThird Party Advisory

https://github.com/libarchive/libarchive/commit/05caadc7eedbef471ac9610809ba683f0c698700

Source: cret@cert.org

Issue TrackingPatch

https://github.com/libarchive/libarchive/issues/719

Source: cret@cert.org

Issue TrackingPatch

https://security.gentoo.org/glsa/201701-03

Source: cret@cert.org

http://blog.talosintel.com/2016/06/the-poisoned-archives.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1348444

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2016/dsa-3657

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/91331

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.talosintel.com/reports/TALOS-2016-0154/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/libarchive/libarchive/commit/05caadc7eedbef471ac9610809ba683f0c698700

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://github.com/libarchive/libarchive/issues/719

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://security.gentoo.org/glsa/201701-03

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.