Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libarchive | Aug 30, 2017 | Sep 21, 2016 |
| Amazon_linux | — | Upgrade libarchive | Sep 27, 2016 | Sep 21, 2016 |
| Centos_linux | — | Upgrade libarchive-develUpgrade bsdtarUpgrade libarchiveUpgrade bsdcpio | Sep 16, 2016 | Sep 16, 2016 |
| Debian | — | Upgrade libarchive | Aug 31, 2016 | Aug 30, 2016 |
| Freebsd | — | Upgrade libarchive | Dec 10, 2025 | Jun 23, 2016 |
| Gentoo Linux | — | Upgrade app-arch/libarchive. | Oct 30, 2017 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade libarchive | Nov 30, 2017 | Sep 21, 2016 |
| Oracle Solaris | — | Upgrade library/libarchive to version 3.2.1-0.175.3.11.0.1.0 on Solaris 11.3 | May 29, 2017 | Sep 21, 2016 |
| Oracle_linux | — | Upgrade libarchive-develUpgrade libarchiveUpgrade bsdcpioUpgrade bsdtar | Sep 12, 2016 | Jun 19, 2016 |
| Redhat_linux | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchiveUpgrade libarchive-debuginfoUpgrade bsdcpio | Oct 21, 2016 | Sep 12, 2016 |
| Suse | — | Upgrade libarchive-develUpgrade bsdtarUpgrade libarchive13 | Jul 29, 2016 | Jul 29, 2016 |
| Ubuntu | — | Upgrade libarchive13Upgrade libarchive12 | Jul 14, 2016 | Jul 14, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub