CVE-2013-0211

Publication date 25 March 2013

Last updated 24 July 2024

Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libarchive	14.10 utopic	Not affected
	14.04 LTS trusty	Not affected
	13.10 saucy	Ignored
	13.04 raring	Ignored
	12.10 quantal	Ignored
	12.04 LTS precise	Fixed 3.0.3-6ubuntu1.1
	11.10 oneiric	Ignored
	10.04 LTS lucid	Ignored
	8.04 LTS hardy	Ignored

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libarchive	Upstream: 2253154

References

Related Ubuntu Security Notices (USN)

USN-2549-1
libarchive vulnerabilities
25 March 2015

Other references

https://www.cve.org/CVERecord?id=CVE-2013-0211