Synopsis

Important: libarchive security update

Type/Severity

Security Advisory: Important

Topic

An update for libarchive is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive. (CVE-2016-5418)
  
• Multiple out-of-bounds read flaws were found in libarchive. Specially crafted AR or MTREE files could cause the application to read data out of bounds, potentially disclosing a small amount of application memory, or causing an application crash. (CVE-2015-8920, CVE-2015-8921)
  
• A denial of service vulnerability was found in libarchive's handling of GZIP streams. A crafted GZIP file could cause libarchive to allocate an excessive amount of memory, eventually leading to a crash. (CVE-2016-7166)
  
• A denial of service vulnerability was found in libarchive. A specially crafted CPIO archive containing a symbolic link to a large target path could cause memory allocation to fail, causing an application using libarchive that attempted to view or extract such archive to crash. (CVE-2016-4809)
  
• Multiple instances of undefined behavior due to arithmetic overflow were found in libarchive. Specially crafted Compress streams or ISO9660 volumes could potentially cause the application to fail to read the archive, or to crash. (CVE-2015-8932, CVE-2016-5844)
  

Red Hat would like to thank Insomnia Security for reporting CVE-2016-5418.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

• BZ - 1347084 - CVE-2016-4809 libarchive: Memory allocate error with symbolic links in cpio archives
• BZ - 1347086 - CVE-2016-7166 libarchive: Denial of service using a crafted gzip file
• BZ - 1348416 - CVE-2015-8920 libarchive: Stack out of bounds read in ar parser
• BZ - 1348772 - CVE-2015-8921 libarchive: Global out of bounds read in mtree parser
• BZ - 1348780 - CVE-2015-8932 libarchive: Undefined behavior / invalid shiftleft in TAR parser
• BZ - 1350280 - CVE-2016-5844 libarchive: undefined behaviour (integer overflow) in iso parser
• BZ - 1362601 - CVE-2016-5418 libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite

CVEs

• CVE-2015-8920
• CVE-2015-8921
• CVE-2015-8932
• CVE-2016-4809
• CVE-2016-5418
• CVE-2016-5844
• CVE-2016-7166

References

• http://www.redhat.com/security/updates/classification/#normal

Red Hat Enterprise Linux Server 6

SRPM
libarchive-2.8.3-7.el6_8.src.rpm	SHA-256: 08b77bc584d50aadd20e4be6a96b9fdeae5dc54c29bfeb7cc927ede0f77ec151
x86_64
libarchive-2.8.3-7.el6_8.i686.rpm	SHA-256: 21286ceb534ea723fdb6d9d6bac27a1140f2d995d1ad8953abce3cc45ddb4735
libarchive-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 31407afe553841f4693299cd0bef3a3f7b63365850597adc6e349c4d28e38d2c
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.x86_64.rpm	SHA-256: b70c326ee908231397c3c5dba59d691c44749e83f5f172b550f6636ced7eed45
libarchive-debuginfo-2.8.3-7.el6_8.x86_64.rpm	SHA-256: b70c326ee908231397c3c5dba59d691c44749e83f5f172b550f6636ced7eed45
libarchive-devel-2.8.3-7.el6_8.i686.rpm	SHA-256: 582d54028f44156d05d05c7a7e3ea782341b4154b99244dace78ecdfee6df61c
libarchive-devel-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 7c52230d6cfd83f9446b7aa7e2932a160cea961ac88b0959978fbbad8efcc2c2
i386
libarchive-2.8.3-7.el6_8.i686.rpm	SHA-256: 21286ceb534ea723fdb6d9d6bac27a1140f2d995d1ad8953abce3cc45ddb4735
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-devel-2.8.3-7.el6_8.i686.rpm	SHA-256: 582d54028f44156d05d05c7a7e3ea782341b4154b99244dace78ecdfee6df61c

Red Hat Enterprise Linux Workstation 6

SRPM
libarchive-2.8.3-7.el6_8.src.rpm	SHA-256: 08b77bc584d50aadd20e4be6a96b9fdeae5dc54c29bfeb7cc927ede0f77ec151
x86_64
libarchive-2.8.3-7.el6_8.i686.rpm	SHA-256: 21286ceb534ea723fdb6d9d6bac27a1140f2d995d1ad8953abce3cc45ddb4735
libarchive-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 31407afe553841f4693299cd0bef3a3f7b63365850597adc6e349c4d28e38d2c
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.x86_64.rpm	SHA-256: b70c326ee908231397c3c5dba59d691c44749e83f5f172b550f6636ced7eed45
libarchive-debuginfo-2.8.3-7.el6_8.x86_64.rpm	SHA-256: b70c326ee908231397c3c5dba59d691c44749e83f5f172b550f6636ced7eed45
libarchive-devel-2.8.3-7.el6_8.i686.rpm	SHA-256: 582d54028f44156d05d05c7a7e3ea782341b4154b99244dace78ecdfee6df61c
libarchive-devel-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 7c52230d6cfd83f9446b7aa7e2932a160cea961ac88b0959978fbbad8efcc2c2
i386
libarchive-2.8.3-7.el6_8.i686.rpm	SHA-256: 21286ceb534ea723fdb6d9d6bac27a1140f2d995d1ad8953abce3cc45ddb4735
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-devel-2.8.3-7.el6_8.i686.rpm	SHA-256: 582d54028f44156d05d05c7a7e3ea782341b4154b99244dace78ecdfee6df61c

Red Hat Enterprise Linux Desktop 6

SRPM
libarchive-2.8.3-7.el6_8.src.rpm	SHA-256: 08b77bc584d50aadd20e4be6a96b9fdeae5dc54c29bfeb7cc927ede0f77ec151
x86_64
libarchive-2.8.3-7.el6_8.i686.rpm	SHA-256: 21286ceb534ea723fdb6d9d6bac27a1140f2d995d1ad8953abce3cc45ddb4735
libarchive-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 31407afe553841f4693299cd0bef3a3f7b63365850597adc6e349c4d28e38d2c
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.x86_64.rpm	SHA-256: b70c326ee908231397c3c5dba59d691c44749e83f5f172b550f6636ced7eed45
libarchive-debuginfo-2.8.3-7.el6_8.x86_64.rpm	SHA-256: b70c326ee908231397c3c5dba59d691c44749e83f5f172b550f6636ced7eed45
libarchive-devel-2.8.3-7.el6_8.i686.rpm	SHA-256: 582d54028f44156d05d05c7a7e3ea782341b4154b99244dace78ecdfee6df61c
libarchive-devel-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 7c52230d6cfd83f9446b7aa7e2932a160cea961ac88b0959978fbbad8efcc2c2
i386
libarchive-2.8.3-7.el6_8.i686.rpm	SHA-256: 21286ceb534ea723fdb6d9d6bac27a1140f2d995d1ad8953abce3cc45ddb4735
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-devel-2.8.3-7.el6_8.i686.rpm	SHA-256: 582d54028f44156d05d05c7a7e3ea782341b4154b99244dace78ecdfee6df61c

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
libarchive-2.8.3-7.el6_8.src.rpm	SHA-256: 08b77bc584d50aadd20e4be6a96b9fdeae5dc54c29bfeb7cc927ede0f77ec151
s390x
libarchive-2.8.3-7.el6_8.s390.rpm	SHA-256: 4e298cee2ccf6875b4644e66195c9af3c221f40c813501025e3a6602f13f04f8
libarchive-2.8.3-7.el6_8.s390x.rpm	SHA-256: 16eafedc100a83392b879f043bde66452fa8b99c1bfa529f3e3d255566ad335d
libarchive-debuginfo-2.8.3-7.el6_8.s390.rpm	SHA-256: 3b74c628bafc02d7d613a117ae7dd8d68b5a9367c90f755c5bf4af15d0fa8f13
libarchive-debuginfo-2.8.3-7.el6_8.s390.rpm	SHA-256: 3b74c628bafc02d7d613a117ae7dd8d68b5a9367c90f755c5bf4af15d0fa8f13
libarchive-debuginfo-2.8.3-7.el6_8.s390x.rpm	SHA-256: ab1295facdd0c3e2bb6fa9af8b48a28410147d2e2ff6562b02aab152e09d90ba
libarchive-debuginfo-2.8.3-7.el6_8.s390x.rpm	SHA-256: ab1295facdd0c3e2bb6fa9af8b48a28410147d2e2ff6562b02aab152e09d90ba
libarchive-devel-2.8.3-7.el6_8.s390.rpm	SHA-256: 2228e116525d3af67657661e16e9e9a848ee37ef0cf48e3e734b1108d0a6d1f0
libarchive-devel-2.8.3-7.el6_8.s390x.rpm	SHA-256: 0f8f8d8b2d9ba6b731bb586a6757af077b0e960738dc56b64823ef5cb9d956ae

Red Hat Enterprise Linux for Power, big endian 6

SRPM
libarchive-2.8.3-7.el6_8.src.rpm	SHA-256: 08b77bc584d50aadd20e4be6a96b9fdeae5dc54c29bfeb7cc927ede0f77ec151
ppc64
libarchive-2.8.3-7.el6_8.ppc.rpm	SHA-256: 621e6bb83e9824a6991cb133d86e4d57b54323c505e9a8f01f5b89ce257810dc
libarchive-2.8.3-7.el6_8.ppc64.rpm	SHA-256: cbef40c529bdd6716400d725725f880084553485a2e0d66bc449c25e237e2752
libarchive-debuginfo-2.8.3-7.el6_8.ppc.rpm	SHA-256: 034847b8c22d340c3772de701b088f2e97d8f57ccd0baf13682fd86b7d43eb52
libarchive-debuginfo-2.8.3-7.el6_8.ppc.rpm	SHA-256: 034847b8c22d340c3772de701b088f2e97d8f57ccd0baf13682fd86b7d43eb52
libarchive-debuginfo-2.8.3-7.el6_8.ppc64.rpm	SHA-256: 3f2a88154dbadab4d997736eec4b08264063116985dd49c0a9f38b6bf30c5039
libarchive-debuginfo-2.8.3-7.el6_8.ppc64.rpm	SHA-256: 3f2a88154dbadab4d997736eec4b08264063116985dd49c0a9f38b6bf30c5039
libarchive-devel-2.8.3-7.el6_8.ppc.rpm	SHA-256: 04953f7b0a3c8264513135b4ff27d0b358715269c1d4e41a161e31b3274adab7
libarchive-devel-2.8.3-7.el6_8.ppc64.rpm	SHA-256: c276efcd50ff6e9cc5b1f67ce8975b4765beaed08f87c7db70872c6f692f4989

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
libarchive-2.8.3-7.el6_8.src.rpm	SHA-256: 08b77bc584d50aadd20e4be6a96b9fdeae5dc54c29bfeb7cc927ede0f77ec151
x86_64
libarchive-2.8.3-7.el6_8.i686.rpm	SHA-256: 21286ceb534ea723fdb6d9d6bac27a1140f2d995d1ad8953abce3cc45ddb4735
libarchive-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 31407afe553841f4693299cd0bef3a3f7b63365850597adc6e349c4d28e38d2c
libarchive-debuginfo-2.8.3-7.el6_8.i686.rpm	SHA-256: e86165dd0a19e75c85786935c3a74f68c73625d04b34fd4a7d64d33d0a0c003f
libarchive-debuginfo-2.8.3-7.el6_8.x86_64.rpm	SHA-256: b70c326ee908231397c3c5dba59d691c44749e83f5f172b550f6636ced7eed45
libarchive-devel-2.8.3-7.el6_8.i686.rpm	SHA-256: 582d54028f44156d05d05c7a7e3ea782341b4154b99244dace78ecdfee6df61c
libarchive-devel-2.8.3-7.el6_8.x86_64.rpm	SHA-256: 7c52230d6cfd83f9446b7aa7e2932a160cea961ac88b0959978fbbad8efcc2c2