This site requires JavaScript to be enabled to function correctly, please enable it.
Summary:
CVE-2016-7166 libarchive: Denial of service using a crafted gzip file
Product:
[Other] Security Response
Reporter:
Doran Moppert <dmoppert>
Component:
vulnerability Assignee:
Red Hat Product Security <security-response-team>
Status:
CLOSED
ERRATA
QA Contact:
Severity:
low
Docs Contact:
Priority:
low
Version:
unspecified CC:
dmoppert, jrusnack, ndevos, praiskup, sardella, slawomir, todoleza
Target Milestone:
--- Keywords:
Security
Target Release:
---
Hardware:
All
OS:
Linux
Whiteboard:
Fixed In Version:
libarchive 3.2.0
Doc Type:
Bug Fix
Doc Text:
A vulnerability was found in libarchive. A specially crafted gzip file can cause libarchive to allocate memory without limit, eventually leading to a crash.
Story Points:
---
Clone Of:
Environment:
Last Closed:
2019-06-08 02:55:01 UTC
Type:
---
Regression:
---
Mount Type:
---
Documentation:
---
CRM:
Verified Versions:
Category:
---
oVirt Team:
---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:
---
Target Upstream Version:
Embargoed:
Bug Depends On:
1352775 , 1352776 , 1353065 , 1353066 , 1353067 , 1353068
Bug Blocks:
1334215
A specially crafted gzip file can cause libarchive to allocate memory without limit, eventually leading to a crash. External references: https://github.com/libarchive/libarchive/issues/660 Upstream fix: https://github.com/libarchive/libarchive/commit/6e06b1c89