CVE-2016-7166

MEDIUM 5.5CVE-2016-7166 · Published 21/09/2016 · updated 17/06/2026

In short

CVE-2016-7166 is a MEDIUM (CVSS 5.5) vulnerability affecting libarchive (libarchive).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
libarchive libarchive	`≤ 3.1.901a`	No fix yet

Description

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.

References

rhn.redhat.com/errata/RHSA-2016-1844.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2016-1850.html · Third Party Advisory
openwall.com/lists/oss-security/2016/09/08/15 · Mailing List
openwall.com/lists/oss-security/2016/09/08/18 · Mailing List
oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html · Third Party Advisory
securityfocus.com/bid/92901 · Third Party Advisory
bugs.freebsd.org/bugzilla/show_bug.cgi · Issue Tracking
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
libarchive/libarchive commit 6e06b1c · Issue Tracking
libarchive/libarchive · Issue Tracking
security.gentoo.org/glsa/201701-03

More vulnerabilities in libarchive

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

libarchive

≤ 3.1.901a

No fix yet

More vulnerabilities in libarchive

See all →