CVE-2016-1925 Integer overflow in n/a
Remote attackers can trigger a buffer overflow via integer underflow in lha archives, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1925?
CVE-2016-1925 is a critical vulnerability in n/a, published on 23 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer underflow in header.c in lha allows remote attackers to have unspecified impact via a large header size value for the (1) level0 or (2) level1 header in a lha archive, which triggers a buffer overflow.
Weakness: CWE-191
Which versions are affected by CVE-2016-1925?
It affects 1 product.
Linux distribution packages (2)
lha SUSE:Linux Enterprise Server 11 SP4 | All versions | 1.14.0.894-3.1 |
lha SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 1.14.0.894-3.1 |
Products include Lha for Unix Project Lha for Unix.
How do I fix CVE-2016-1925?
Apply the vendor's patch.
Is CVE-2016-1925 being exploited?
There is no known exploitation of CVE-2016-1925 in the wild and no public exploit code.
Sources
Also known as GHSA-c9qr-jrpq-4qqr, MGASA-2016-0142, SUSE-SU-2016:1904-1.