CVE-2016-8688

The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detectform or (2) bidentry function in libarchive/archivereadsupportformatmtree.c.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "42.2"
                }
            ],
            "vendor_product": "opensuse:leap",
            "cpes": [
                "cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

CVE-2016-8688

Affected packages