CVE-2016-2347
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2016-2347
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2347.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2016-2347
- Downstream
- Related
- Published
- 2017-04-21T20:59:00.557Z
- Modified
- 2025-11-14T04:33:38.789545Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Integer underflow in the decodelevel3header function in lib/lhafileheader.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
- References
-
- http://lists.opensuse.org/opensuse-updates/2016-04/msg00038.html
- http://lists.opensuse.org/opensuse-updates/2016-04/msg00039.html
- http://www.debian.org/security/2016/dsa-3540
- http://www.talosintelligence.com/reports/TALOS-2016-0095/
- https://github.com/fragglet/lhasa/commit/6fcdb8f1f538b9d63e63a5fa199c5514a15d4564
- https://github.com/fragglet/lhasa/releases/tag/v0.3.1
Affected packages
Git / github.com/fragglet/lhasa
Affected ranges
- Type
- GIT
- Repo
- https://github.com/fragglet/lhasa
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Database specific
vanir_signatures
[
{
"signature_version": "v1",
"target": {
"function": "extend_raw_data",
"file": "lib/lha_file_header.c"
},
"id": "CVE-2016-2347-127c86b4",
"source": "https://github.com/fragglet/lhasa/commit/6fcdb8f1f538b9d63e63a5fa199c5514a15d4564",
"digest": {
"function_hash": "205213664740166912401818331102733821536",
"length": 450.0
},
"signature_type": "Function",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"function": "decode_level3_header",
"file": "lib/lha_file_header.c"
},
"id": "CVE-2016-2347-2951ef9d",
"source": "https://github.com/fragglet/lhasa/commit/6fcdb8f1f538b9d63e63a5fa199c5514a15d4564",
"digest": {
"function_hash": "243803080807595711965693796938017383515",
"length": 919.0
},
"signature_type": "Function",
"deprecated": false
},
{
"signature_version": "v1",
"target": {
"file": "lib/lha_file_header.c"
},
"id": "CVE-2016-2347-9e27d471",
"source": "https://github.com/fragglet/lhasa/commit/6fcdb8f1f538b9d63e63a5fa199c5514a15d4564",
"digest": {
"threshold": 0.9,
"line_hashes": [
"81857088144805919651521459705044896562",
"90865436915124334063461346229748683849",
"168603969358282847260008075131334827623",
"101587154781056942032226788173318447276",
"164140291529182583489359734877066170927",
"271716932972871301892963359679777099513",
"72133410738862859589332295645323222629"
]
},
"signature_type": "Line",
"deprecated": false
}
]