CVE-2015-8927

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/06/17/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/17/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/91329
https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.htmlThird Party Advisory
https://github.com/libarchive/libarchive/issues/523Exploit, Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201701-03
http://www.openwall.com/lists/oss-security/2016/06/17/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/17/5Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/91329
https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.htmlThird Party Advisory
https://github.com/libarchive/libarchive/issues/523Exploit, Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201701-03

Timeline

Published: Sep 20, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-89285.5The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial o CVE-2015-89295.5Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to caus CVE-2015-89307.5bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a CVE-2015-89317.8Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive b CVE-2015-89325.5The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a de CVE-2015-89335.5Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote CVE-2015-89345.5The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a d CVE-2015-89356.1The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line foldin CVE-2015-89366.1Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script o CVE-2015-89377.8drivers/char/diag/diagchar_core.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices mishandles a s CVE-2015-89387.8The MSM camera driver in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate input parameters, which a CVE-2015-89397.8drivers/video/msm/mdp4_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices does not validate r stages,