The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

bsdtar-3.2.2-2.1 on GA media

libarchive: Stack out of bounds read in ar parser libarchive: Global out of bounds read in mtree parser libarchive: Undefined behavior / invalid shiftleft in TAR parser libarchive: Memory allocate error with symbolic links in cpio archives libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite libarchive: undefined behaviour (integer overflow) in iso parser libarchive: Denial of service using a crafted gzip file

Security update for libarchive

Affected: Ubuntu:14.04:LTS: libarchive, Ubuntu:16.04:LTS: libarchive

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.