A crafted 7zip archive with multiple headers of the same kind could cause calculated values from one being used to interpret the other, leading to out-of-bounds reads of adjacent structures on the heap. Disclosed on oss-security: http://seclists.org/oss-sec/2016/q3/516 Upstream issue: https://github.com/libarchive/libarchive/issues/761 Upstream fix: https://github.com/libarchive/libarchive/commit/7f17c79
Code execution is not possible with this flaw, and the information disclosure is limited in both size and scope.
Created libarchive tracking bugs for this issue: Affects: fedora-all [bug 1378668]
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
*** Bug 1385670 has been marked as a duplicate of this bug. ***