Bug 586182 – <app-arch/libarchive-3.2.1-r3: Multiple vulnerabilities (CVE-2015-{8916,8917,8918,8919,8920,8921,8922,8923,8924,8925,8926,8927,8928,8929,8930,8931,8932,8933,8934})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hanno Böck 2016-06-17 13:04:29 UTC]

I have discovered and reported a large number of out of bounds memory reads, null pointer accesses and other issues to libarchive. Most of them (except unfortunately one, I asked upstream about the status) have been fixed in 3.2.0:
https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html

Please bump to 3.2.0.

[Comment 1 Hanno Böck 2016-06-20 17:23:53 UTC]

The rar issue that was unfixed in 3.2.0 (CVE-2015-8934) is now fixed in 3.2.1 (+ one integer overflow issue). Therefore please bump to 3.2.1.

CVE-2015-8915 - CVE-2015-8933 all got assigned to issues fixed in 3.2.0.

[Comment 2 Aaron Bauman (RETIRED) 2016-06-27 12:05:57 UTC]

(In reply to Hanno Boeck from comment #1)
> The rar issue that was unfixed in 3.2.0 (CVE-2015-8934) is now fixed in
> 3.2.1 (+ one integer overflow issue). Therefore please bump to 3.2.1.
> 
> CVE-2015-8915 - CVE-2015-8933 all got assigned to issues fixed in 3.2.0.

Additionally,

http://www.talosintel.com/reports/TALOS-2016-0152/

http://www.talosintel.com/reports/TALOS-2016-0153/

http://www.talosintel.com/reports/TALOS-2016-0154/

[Comment 3 William Hubbs 2016-07-02 00:10:01 UTC]

I bumped this to 3.2.1.

[Comment 4 Aaron Bauman (RETIRED) 2016-07-02 00:14:19 UTC]

(In reply to William Hubbs from comment #3)
> I bumped this to 3.2.1.

Thanks!

@maintainer(s), would you like to let it bake for awhile or push on to stabilization?

[Comment 5 Adam Feldman 2016-07-02 00:31:14 UTC]

(In reply to Aaron Bauman from comment #4)
> (In reply to William Hubbs from comment #3)
> > I bumped this to 3.2.1.
> 
> Thanks!
> 
> @maintainer(s), would you like to let it bake for awhile or push on to
> stabilization?

I don't really understand what "let it bake for a while" means.

Considering the huge amount of changes in upstream between 3.1 and 3.2, it'd probably be best to  hold off on stabilizing immediately, if possible (the reason why I haven't managed to bump it myself was it required a lot of attention)

[Comment 6 Aaron Bauman (RETIRED) 2016-07-02 01:02:15 UTC]

(In reply to NP-Hardass from comment #5)
> (In reply to Aaron Bauman from comment #4)
> > (In reply to William Hubbs from comment #3)
> > > I bumped this to 3.2.1.
> > 
> > Thanks!
> > 
> > @maintainer(s), would you like to let it bake for awhile or push on to
> > stabilization?
> 
> I don't really understand what "let it bake for a while" means.
> 
> Considering the huge amount of changes in upstream between 3.1 and 3.2, it'd
> probably be best to  hold off on stabilizing immediately, if possible (the
> reason why I haven't managed to bump it myself was it required a lot of
> attention)

Thanks for the information.  Please call for stabilization when you are ready.

[Comment 7 Adam Feldman 2016-07-16 18:30:22 UTC]

Alright, we should be all good to stabilize on all arches.  Please note that several arches are listed as unstable arches, but have stable keywords on ~3.1.2, so, after consulting those arches, we should probably just drop stable keywords for those arches. There are currently stable keywords for every arch but mips.

[Comment 8 Aaron Bauman (RETIRED) 2016-07-17 00:51:05 UTC]

@arches, please stabilize:

=app-arch/libarchive-3.2.1-r3

[Comment 9 Tobias Klausmann (RETIRED) 2016-07-17 11:51:47 UTC]

Stable on alpha.

[Comment 10 Jeroen Roovers (RETIRED) 2016-07-17 19:37:04 UTC]

Stable for HPPA PPC64.

[Comment 11 Agostino Sarubbo 2016-07-18 08:50:33 UTC]

amd64 stable

[Comment 12 Agostino Sarubbo 2016-07-18 08:51:05 UTC]

x86 stable

[Comment 13 Adam Feldman 2016-07-26 18:19:13 UTC]

The cc'd arches have stable keywords on 3.1.2, despite being listed as unstable arches.  Please either drop stable keywords or stabilize 3.2.1.


Ping @ remaining arches to stabilize so we can drop the security issue riddled and ancient versions

[Comment 14 Aaron Bauman (RETIRED) 2016-07-27 10:01:27 UTC]

(In reply to NP-Hardass from comment #13)
> The cc'd arches have stable keywords on 3.1.2, despite being listed as
> unstable arches.  Please either drop stable keywords or stabilize 3.2.1.
> 
> 
> Ping @ remaining arches to stabilize so we can drop the security issue
> riddled and ancient versions

Yes, they should be dropped as they are not supported by security nor the stable tree.  If they currently have stable keywords they do not continue those forward regardless of repoman complaining.  The rest of Gentoo should not wait on these, which is why such designations are put in place.

[Comment 15 Markus Meier 2016-07-27 20:26:27 UTC]

arm stable

[Comment 16 Agostino Sarubbo 2016-09-29 09:36:41 UTC]

sparc stable

[Comment 17 Agostino Sarubbo 2016-09-29 12:37:38 UTC]

ppc stable

[Comment 18 Agostino Sarubbo 2016-09-29 13:30:06 UTC]

ia64 stable

[Comment 19 GLSAMaker/CVETool Bot 2016-11-21 10:22:29 UTC]

CVE-2015-8934 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8934):
  The copy_from_lzss_window function in archive_read_support_format_rar.c in
  libarchive 3.2.0 and earlier allows remote attackers to cause a denial of
  service (out-of-bounds heap read) via a crafted rar file.

CVE-2015-8933 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8933):
  Integer overflow in the archive_read_format_tar_skip function in
  archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote
  attackers to cause a denial of service (crash) via a crafted tar file.

CVE-2015-8932 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8932):
  The compress_bidder_init function in archive_read_support_filter_compress.c
  in libarchive before 3.2.0 allows remote attackers to cause a denial of
  service (crash) via a crafted tar file, which triggers an invalid left
  shift.

CVE-2015-8931 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8931):
  Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min
  functions in archive_read_support_format_mtree.c in libarchive before 3.2.0
  allow remote attackers to have unspecified impact via a crafted mtree file,
  which triggers undefined behavior.

CVE-2015-8930 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8930):
  bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial
  of service (infinite loop) via an ISO with a directory that is a member of
  itself.

CVE-2015-8929 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8929):
  Memory leak in the __archive_read_get_extract function in
  archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers
  to cause a denial of service via a tar file.

CVE-2015-8928 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8928):
  The process_add_entry function in archive_read_support_format_mtree.c in
  libarchive before 3.2.0 allows remote attackers to cause a denial of service
  (out-of-bounds read) via a crafted mtree file.

CVE-2015-8927 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8927):
  The trad_enc_decrypt_update function in archive_read_support_format_zip.c in
  libarchive before 3.2.0 allows remote attackers to cause a denial of service
  (out-of-bounds heap read and crash) via a crafted zip file, related to
  reading the password.

CVE-2015-8926 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8926):
  The archive_read_format_rar_read_data function in
  archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote
  attackers to cause a denial of service (crash) via a crafted rar archive.

CVE-2015-8925 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8925):
  The readline function in archive_read_support_format_mtree.c in libarchive
  before 3.2.0 allows remote attackers to cause a denial of service (invalid
  read) via a crafted mtree file, related to newline parsing.

CVE-2015-8924 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8924):
  The archive_read_format_tar_read_header function in
  archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote
  attackers to cause a denial of service (out-of-bounds read) via a crafted
  tar file.

CVE-2015-8923 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8923):
  The process_extra function in libarchive before 3.2.0 uses the size field
  and a signed number in an offset, which allows remote attackers to cause a
  denial of service (crash) via a crafted zip file.

CVE-2015-8922 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8922):
  The read_CodersInfo function in archive_read_support_format_7zip.c in
  libarchive before 3.2.0 allows remote attackers to cause a denial of service
  (NULL pointer dereference and crash) via a crafted 7z file, related to the
  _7z_folder struct.

CVE-2015-8921 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8921):
  The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0
  allows remote attackers to cause a denial of service (out-of-bounds read)
  via a crafted mtree file.

CVE-2015-8920 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8920):
  The _ar_read_header function in archive_read_support_format_ar.c in
  libarchive before 3.2.0 allows remote attackers to cause a denial of service
  (out-of-bounds stack read) via a crafted ar file.

CVE-2015-8919 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8919):
  The lha_read_file_extended_header function in
  archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote
  attackers to cause a denial of service (out-of-bounds heap) via a crafted
  (1) lzh or (2) lha file.

CVE-2015-8918 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8918):
  The archive_string_append function in archive_string.c in libarchive before
  3.2.0 allows remote attackers to cause a denial of service (crash) via a
  crafted cab files, related to "overlapping memcpy."

CVE-2015-8917 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8917):
  bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial
  of service (NULL pointer dereference and crash) via an invalid character in
  the name of a cab file.

CVE-2015-8916 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8916):
  bsdtar in libarchive before 3.2.0 returns a success code without filling the
  entry when the header is a "split file in multivolume RAR," which allows
  remote attackers to cause a denial of service (NULL pointer dereference and
  crash) via a crafted rar file.

CVE-2015-8915 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8915):
  bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial
  of service (invalid read and crash) via crafted cpio file.

[Comment 20 Aaron Bauman (RETIRED) 2016-11-21 10:24:48 UTC]

Removing unstable arches. Added to existing GLSA.

[Comment 21 Thomas Deutschmann (RETIRED) 2017-01-01 14:10:05 UTC]

CVE-2015-8915 has its own bug report (bug 548110).

[Comment 22 GLSAMaker/CVETool Bot 2017-01-01 14:34:44 UTC]

This issue was resolved and addressed in
 GLSA 201701-03 at https://security.gentoo.org/glsa/201701-03
by GLSA coordinator Thomas Deutschmann (whissi).