CVE-2007-3645

Severity

43%

Complexity

86%

Confidentiality

48%

The vendor has released an update addressing this issue: http://people.freebsd.org/~kientzle/libarchive/

archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (crash) via (1) an end-of-file condition within a tar header that follows a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive, which results in a NULL pointer dereference, a different issue than CVE-2007-3644.

The vendor has released an update addressing this issue: http://people.freebsd.org/~kientzle/libarchive/

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P).

Overview

First reported 17 years ago

2007-07-15 21:30:00

Last updated 7 years ago

2017-07-29 01:32:00

Affected Software

FreeBSD libarchive

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=432924

38093

38094

http://people.freebsd.org/~kientzle/libarchive/

26050

Patch, Vendor Advisory

26062

Patch, Vendor Advisory

26355

28377

FreeBSD-SA-07:05.libarchive

Patch, Vendor Advisory

http://security.freebsd.org/patches/SA-07:05/libarchive.patch

Patch

GLSA-200708-03

DSA-1455

SUSE-SR:2007:015

24885

Patch

1018379

ADV-2007-2521

freebsd-libarchive-null-pax-dos(35404)

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.