CVE-2016-5418

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-19 CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-1844.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1850.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/09/2Exploit, Technical Description
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
http://www.securityfocus.com/bid/93165
https://access.redhat.com/errata/RHSA-2016:1852Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1853Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1362601Issue Tracking, Third Party Advisory, VDB Entry
https://gist.github.com/anonymous/e48209b03f1dd9625a992717e7b89c4fExploit, Technical Description
https://github.com/libarchive/libarchive/commit/dfd6b54ce33960e420fb206d8872fb759b577ad9Patch
https://github.com/libarchive/libarchive/issues/746Exploit, Patch
https://security.gentoo.org/glsa/201701-03
http://rhn.redhat.com/errata/RHSA-2016-1844.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1850.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2016/08/09/2Exploit, Technical Description
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
http://www.securityfocus.com/bid/93165
https://access.redhat.com/errata/RHSA-2016:1852Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1853Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1362601Issue Tracking, Third Party Advisory, VDB Entry
https://gist.github.com/anonymous/e48209b03f1dd9625a992717e7b89c4fExploit, Technical Description
https://github.com/libarchive/libarchive/commit/dfd6b54ce33960e420fb206d8872fb759b577ad9Patch
https://github.com/libarchive/libarchive/issues/746Exploit, Patch
https://security.gentoo.org/glsa/201701-03

Timeline

Published: Sep 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-54197.5curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers CVE-2016-54207.5curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attac CVE-2016-54218.1Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified othe CVE-2016-54228.8The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user CVE-2016-54238.3PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated us CVE-2016-54247.1PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authentica CVE-2016-54257.8The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak perm CVE-2016-54267.5PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a CVE-2016-54277.5PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to ca CVE-2016-54293.7jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensit CVE-2016-54305.3The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism CVE-2016-54317.5The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting