USN-2981-1: libarchive vulnerabilities | Ubuntu security notices

Packages

libarchive - Library to read/write archive files

Details

It was discovered that libarchive incorrectly handled certain entry-size
values in ZIP archives. A remote attacker could use this issue to cause
libarchive to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10
and Ubuntu 16.04 LTS. (CVE-2016-1541)

It was discovered that libarchive incorrectly handled memory when
processing certain tar files. A remote attacker could use this issue to
cause libarchive to crash, resulting in a denial of service. (CVE number
pending)

It was discovered that libarchive incorrectly handled certain entry-size
values in ZIP archives. A remote attacker could use this issue to cause
libarchive to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10
and Ubuntu 16.04 LTS. (CVE-2016-1541)

It was discovered that libarchive incorrectly handled memory when
processing certain tar files. A remote attacker could use this issue to
cause libarchive to crash, resulting in a denial of service. (CVE number
pending)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
16.04 xenial	libarchive13 – 3.1.2-11ubuntu0.16.04.1
15.10 wily	libarchive13 – 3.1.2-11ubuntu0.15.10.1
14.04 trusty	libarchive13 – 3.1.2-7ubuntu2.2
12.04 precise	libarchive12 – 3.0.3-6ubuntu1.2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2016-1541

CVE-2016-1541