CVE-2015-8920

Low

Low Medium High Critical

CVSS Score

Published: Sep 20, 2016

Last Modified: Apr 12, 2025

Vulnerability Description

The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.

Known Affected Software

7 configuration(s) from 2 vendor(s)

ubuntu_linux

Version:

14.04

CPE:

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

ubuntu_linux

Version:

16.04

CPE:

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*

ubuntu_linux

Version:

15.10

CPE:

cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

ubuntu_linux

Version:

12.04

CPE:

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

suse_linux_enterprise_server

Version:

12.0

CPE:

cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:-:*:*:*:*:*:*

suse_linux_enterprise_desktop

Version:

12.0

CPE:

cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:-:*:*:*:*:*:*

suse_linux_enterprise_software_development_kit

Version:

12.0

CPE:

cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:-:*:*:*:*:*:*

This vulnerability affects 7 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-125 Top 25 #11

Out-of-bounds Read

Description: The product reads data past the end, or before the beginning, of the intended buffer.
Typical Severity: High
Abstraction Level: Base