CVE-2015-8918

moderate-risk
Published 2016-09-20

The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy."

Do I need to act?

~
2.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Novell Libarchive

References (14)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html
Third Party Advisory http://www.openwall.com/lists/oss-security/2016/06/17/2
Third Party Advisory http://www.openwall.com/lists/oss-security/2016/06/17/5
http://www.securityfocus.com/bid/91300
Third Party Advisory https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarch...
Patch https://github.com/libarchive/libarchive/issues/506
https://security.gentoo.org/glsa/201701-03
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html
Third Party Advisory http://www.openwall.com/lists/oss-security/2016/06/17/2
Third Party Advisory http://www.openwall.com/lists/oss-security/2016/06/17/5
http://www.securityfocus.com/bid/91300
Third Party Advisory https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarch...
Patch https://github.com/libarchive/libarchive/issues/506
https://security.gentoo.org/glsa/201701-03
42
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 6/34 · Minimal
Exposure 10/34 · Low