Bug 1005070 – VUL-1: CVE-2016-8687: bsdtar, libarchive: Buffer overflow printing a filename

Bug 1005070 - (CVE-2016-8687) VUL-1: CVE-2016-8687: bsdtar, libarchive: Buffer overflow printing a filename

(CVE-2016-8687)
Summary:	VUL-1: CVE-2016-8687: bsdtar, libarchive: Buffer overflow printing a filename

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Adrian Schröter
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/173644/
Whiteboard:	CVSSv2:NVD:CVE-2016-8687:5.0:(AV:N/AC...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2016-10-17 10:58 UTC by Johannes Segitz
Modified:	2019-11-27 23:36 UTC (History)
CC List:	2 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Johannes Segitz 2016-10-17 10:58:13 UTC

CVE-2016-8687

Reported by Agostino Sarubbo

https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-stack-based-buffer-overflow-in-bsdtar_expand_char-util-c/

AddressSanitizer: stack-buffer-overflow ... WRITE of size 4

Upstream was not able to reproduce the issue, maybe different compiler
and compiler options, so he committed the fix based on what the
stacktrace printed.

Fix is in https://github.com/libarchive/libarchive/commit/e37b620fe8f14535d737e89a4dcabaed4517bf1a

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8687
http://seclists.org/oss-sec/2016/q4/152

Comment 1 Swamp Workflow Management 2016-10-17 22:02:28 UTC

bugbot adjusting priority

Comment 2 Swamp Workflow Management 2016-11-25 15:07:38 UTC

SUSE-SU-2016:2911-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005070,1005072,1005076,986566,989980,998677
CVE References: CVE-2015-2304,CVE-2016-5418,CVE-2016-5844,CVE-2016-6250,CVE-2016-8687,CVE-2016-8688,CVE-2016-8689
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    libarchive-3.1.2-25.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libarchive-3.1.2-25.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    libarchive-3.1.2-25.1
SUSE Linux Enterprise Server 12-SP2 (src):    libarchive-3.1.2-25.1
SUSE Linux Enterprise Server 12-SP1 (src):    libarchive-3.1.2-25.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    libarchive-3.1.2-25.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libarchive-3.1.2-25.1

Comment 3 Swamp Workflow Management 2016-12-05 12:07:51 UTC

openSUSE-SU-2016:3002-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005070,1005072,1005076,986566,989980,998677
CVE References: CVE-2015-2304,CVE-2016-5418,CVE-2016-5844,CVE-2016-6250,CVE-2016-8687,CVE-2016-8688,CVE-2016-8689
Sources used:
openSUSE Leap 42.2 (src):    libarchive-3.1.2-16.1

Comment 4 Swamp Workflow Management 2016-12-05 12:10:28 UTC

openSUSE-SU-2016:3005-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005070,1005072,1005076,986566,989980,998677
CVE References: CVE-2015-2304,CVE-2016-5418,CVE-2016-5844,CVE-2016-6250,CVE-2016-8687,CVE-2016-8688,CVE-2016-8689
Sources used:
openSUSE Leap 42.1 (src):    libarchive-3.1.2-16.1

Comment 7 Adrian Schröter 2018-10-09 14:59:58 UTC

sle 11 should not be affected by this, since it has no multichar support.

Comment 8 Johannes Segitz 2018-10-09 15:02:33 UTC

(In reply to Adrian Schröter from comment #7)
perfect, then we're done here

Comment 13 Swamp Workflow Management 2019-11-27 17:17:28 UTC

SUSE-SU-2019:14233-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005070,1059139,985601,985706
CVE References: CVE-2015-8915,CVE-2015-8925,CVE-2016-8687,CVE-2017-14503
Sources used:
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    bsdtar-2.5.5-10.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.