CVE-2016-10349 - Vulnerability Details - OpenCVE

The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Libarchive	Libarchive

Configuration 1 [-]

cpe:2.3:a:libarchive:libarchive:3.2.2:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/100347
https://github.com/libarchive/libarchive/issues/834
https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
https://nvd.nist.gov/vuln/detail/CVE-2016-10349
https://security.gentoo.org/glsa/201710-19
https://usn.ubuntu.com/3736-1/
https://www.cve.org/CVERecord?id=CVE-2016-10349
https://www.debian.org/security/2018/dsa-4360

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2017-05-01T01:00:00

Updated: 2024-08-06T03:21:50.837Z

Reserved: 2017-04-30T00:00:00

Link: CVE-2016-10349

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-05-01T01:59:00.187

Modified: 2024-11-21T02:43:50.510

Link: CVE-2016-10349

Redhat

Severity : Low

Publid Date: 2016-12-06T00:00:00Z

Links: CVE-2016-10349 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-04-30T00:00:00", "descriptions": [{"lang": "en", "value": "The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-12-28T10:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[debian-lts-announce] 20181129 [SECURITY] [DLA 1600-1] libarchive security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html"}, {"name": "DSA-4360", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2018/dsa-4360"}, {"name": "GLSA-201710-19", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201710-19"}, {"name": "USN-3736-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/3736-1/"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/libarchive/libarchive/issues/834"}, {"name": "100347", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/100347"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-10349", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[debian-lts-announce] 20181129 [SECURITY] [DLA 1600-1] libarchive security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html"}, {"name": "DSA-4360", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4360"}, {"name": "GLSA-201710-19", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201710-19"}, {"name": "USN-3736-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3736-1/"}, {"name": "https://github.com/libarchive/libarchive/issues/834", "refsource": "MISC", "url": "https://github.com/libarchive/libarchive/issues/834"}, {"name": "100347", "refsource": "BID", "url": "http://www.securityfocus.com/bid/100347"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T03:21:50.837Z"}, "title": "CVE Program Container", "references": [{"name": "[debian-lts-announce] 20181129 [SECURITY] [DLA 1600-1] libarchive security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html"}, {"name": "DSA-4360", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2018/dsa-4360"}, {"name": "GLSA-201710-19", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201710-19"}, {"name": "USN-3736-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/3736-1/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/libarchive/libarchive/issues/834"}, {"name": "100347", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/100347"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-10349", "datePublished": "2017-05-01T01:00:00", "dateReserved": "2017-04-30T00:00:00", "dateUpdated": "2024-08-06T03:21:50.837Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libarchive:libarchive:3.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "EE49FE66-2BDF-4237-8BF1-F9851B75B526", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file."}, {"lang": "es", "value": "La funci\u00f3n archive_le32dec function en archive_endian.h en libarchive 3.2.2 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (sobre-lectura de b\u00fafer basada en memoria din\u00e1mica y ca\u00edda de aplicaci\u00f3n) a trav\u00e9s de un fichero manipulado."}], "id": "CVE-2016-10349", "lastModified": "2024-11-21T02:43:50.510", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-01T01:59:00.187", "references": [{"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/100347"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/libarchive/libarchive/issues/834"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201710-19"}, {"source": "cve@mitre.org", "url": "https://usn.ubuntu.com/3736-1/"}, {"source": "cve@mitre.org", "url": "https://www.debian.org/security/2018/dsa-4360"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/100347"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/libarchive/libarchive/issues/834"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201710-19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://usn.ubuntu.com/3736-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2018/dsa-4360"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}