| Package | Affected versions | Patched versions |
|---|---|---|
| libarchive | = 3.2.1 |
The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchive/archive_read_support_format_mtree.c.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free