CVE-2016-6250

8.6HIGH

Key Information:

Vendor
Oracle
Status
Linux
Vendor
CVE Published:
21 September 2016

Summary

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.

References

http://rhn.redhat.com/errata/RHSA-2016-1844.html
vendor-advisoryx_refsource_REDHAT
http://www.oracle.com/technetwork/topics/security/linuxbu...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1036431
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.