CVE-2016-8688

Name of the Vulnerable Software and Affected Versions libarchive version 3.2.1

Description The issue is related to the mtree bidder in libarchive, which does not properly track line sizes when extending the read-ahead. This allows remote attackers to cause a denial of service, resulting in a crash, by providing a crafted file. The crash is triggered by an invalid read in either the detect form or bid entry function in libarchive/archive read support format mtree.c.

Recommendations For libarchive version 3.2.1, consider restricting the use of the mtree bidder until a patch is available. As a temporary workaround, avoid using the detect form or bid entry functions in libarchive/archive read support format mtree.c to minimize the risk of exploitation.