CVE-2017-14503

Name of the Vulnerable Software and Affected Versions: libarchive version 3.3.2

Description: The issue is related to an out-of-bounds read within the lha read data none() function in archive read support format lha.c when extracting a specially crafted lha archive. This is connected to lha crc16. Exploitation of the issue may allow a remote attacker to gain unauthorized access to information using a specially created lha archive.

Recommendations: For libarchive version 3.3.2, as a temporary workaround, consider disabling the lha read data none() function until a patch is available. Restrict access to the archive read support format lha.c module to minimize the risk of exploitation. Avoid using the lha crc16 variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.