Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.2249
libarchive security update
26 September 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libarchive
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Overwrite Arbitrary Files -- Existing Account
Denial of Service -- Existing Account
Unauthorised Access -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2016-7166 CVE-2016-6250 CVE-2016-5418
Reference: ESB-2016.2125
Original Bulletin:
http://www.debian.org/security/2016/dsa-3677
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3677-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
September 25, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : libarchive
CVE ID : CVE-2016-5418 CVE-2016-6250 CVE-2016-7166
Debian Bug : 837714
Several vulnerabilities were discovered in libarchive, a multi-format
archive and compression library, which may lead to denial of service
(memory consumption and application crash), bypass of sandboxing
restrictions and overwrite arbitrary files with arbitrary data from an
archive, or the execution of arbitrary code.
For the stable distribution (jessie), these problems have been fixed in
version 3.1.2-11+deb8u3.
We recommend that you upgrade your libarchive packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQJ8BAEBCgBmBQJX55x2XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ0NjQ0NDA5ODA4QzE3MUUwNTUzMURERUUw
NTRDQjhGMzEzNDNDRjQ0AAoJEAVMuPMTQ89E0qUP/Av6LrM6iVp71waZKi882e7B
0I2HLa4kylWCNhLcPx6Ogr/xk6FMaz3m1sL9jwqXuJ9AUXO8wDbIp1ieCjl92lhW
IbD8dim4HDo/JnAgWhZg/0qrunj2ZV406+jtkdaQSjMYPXhjexb8itcq5IpaEndD
tWpG7ztVw1DjOGzEDwzF7lwcDt38kf7H8eZm7mK121POmMj/9sB1S0ZkEfHVM0r9
BDcY0ne+qnLklg4azxFApj2ANpIONLf9nikUY1gZICzK5Vkxv28qomjDzqvvqzY9
CVHBL3gAeQPNI1zHkwhEXJqDwPL8op2putEVxrEKCWiVhCLewk9gMtGHdNV5urRI
dmyJhQXlV6gnUSd8LcDUpCy45GpBiR2d04BjE/8jLxlIFzwrhezZ+kVr4OBslLvE
csyQ1r0vJRF2e5tmL/hyZNZ9tTd1PB1GMzn6SwB+3OHR9RUQV50MnAtvxF6FMioG
16QwSDxPbe8vt7PRrqy4mGYTBABdO5vPtBSlx9oopjpkcg4C+MM1i37JG2LA3Y+D
wy4SM8vmY2EF3rNW84eD0bys9fGGfWLwCXBHZG+TOXYP3wCk5/6rjX1M510IMOie
EhXAp50U030NATwiXfbQuclf9e2IKG8d5eHTYpmDOTKRvZGK/FlAW2ZhGN0mMRYU
/2Kj3xLD3QENQYOO2ya2
=+5p9
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBV+hoRIx+lLeg9Ub1AQhakxAAoiLD54Z4CQO2aJLUZY6JIgADh4QKJncm
okUuP9QinAq+v3s0MU54fK1o2B6jOhxX0YjFRwT5SHskdsfaenXnrNMoZWx/u7mC
v2nuobYUm3THxcfV+E87UPPqJnZDlAwmQYLnWW+GljdZxxdJo7/YguOILTB//mMk
6+7ISG/npmLlboF50vBWrKOSfWaG6antNGPC4NhH5vJap5ijCVxd+mnrD/R253Lg
12At1wmBA+s3AI5usjC6i/vx57cBARE94XY1Pqa1Xq8BsHmMBpDpQsmdFfzt/kZR
uKszwRY7vX5ArvzkzvXHK6HWFPjqTB9lImB846IQ1no4Gu6N8vVVyoErTZTgOQHp
qjqPQ6SOGYBkwxLW6hYQOzc11jB2JEXMNwPE5MOyrSFcxKQeyhBSP3cYEaoh9Sr3
ijaHtVI13RacsfsXEsF08MgxY6bFdV2fxTqHn42w8ih+FBp/vQyHWrY8ulAhBSLe
qAjsr6qbCxXRmeJVpJ+RXLvmpXaLMp1nzT63ioiw/80ozv4kNST/0utrZQaX2F9P
BEekevyfAGa++OWSA3wrkjQbD4VvK3MjRdJZkpd0iYyuGmMUqyx3yDz0sHVbQJQD
a3vwvosP2mnJ7V+p7Aj6QSerh/uBTSL4LmRF3mwjDWpZyUQ8P6d/mLwjU8STKawV
dn+hOifKLqw=
=a5TA
-----END PGP SIGNATURE-----