CVE-2016-7166

Published: Sep 21, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.

Affected (14)

Products: Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Hpc Node Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Workstation · Libarchive: Libarchive · Oracle: Linux

7 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

1 product

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Workstation	Version 7.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Libarchive Libarchive	Up to 3.1.901a

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Hpc Node	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Workstation	Version 6.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Linux	Version 6
Oracle Linux	Version 7

Related CWEs

References (22)

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1850.html

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/08/15

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/08/18

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/92901

Source: cve@mitre.org

Third Party Advisory

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207362

Source: cve@mitre.org

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1347086

Source: cve@mitre.org

Issue Tracking

https://github.com/libarchive/libarchive/commit/6e06b1c89dd0d16f74894eac4cfc1327a06ee4a0

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/libarchive/libarchive/issues/660

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201701-03

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1850.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/08/15

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/08/18

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/92901

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207362

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=1347086

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://github.com/libarchive/libarchive/commit/6e06b1c89dd0d16f74894eac4cfc1327a06ee4a0

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://github.com/libarchive/libarchive/issues/660

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://security.gentoo.org/glsa/201701-03

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.