CVE-2017-14166

Name of the Vulnerable Software and Affected Versions: libarchive version 3.3.2

Description: The issue is related to errors in handling empty strings in the atol8 function, located in archive read support format xar.c, which can lead to a buffer overflow. This can be exploited by a remote attacker to cause a denial of service, resulting in an application crash due to a heap-based buffer over-read. The exploitation is possible via a crafted xar archive.

Recommendations: For libarchive version 3.3.2, consider disabling the atol8 function in archive read support format xar.c as a temporary workaround to minimize the risk of exploitation. Restrict access to crafted xar archives to prevent potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.