CVE-2017-14166 — libarchive: Heap-based buffer over-read in the atol8 function

Back Back to CVE browser

MEDIUM

libarchive: Heap-based buffer over-read in the atol8 function

Published Sep 6, 2017

6.5

MEDIUM

CVSS 3.0

EPSS 2.77%

Description

libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.

Affected products

Red Hat Enterprise Linux 8

libarchive-0:3.3.3-1.el8

Fixed · RHEA-2021:1580
Red Hat Enterprise Linux 6

libarchive

Will not fix
Red Hat Enterprise Linux 7

libarchive

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	libarchive-0:3.3.3-1.el8	Fixed	RHEA-2021:1580
Red Hat Enterprise Linux 6	libarchive	Will not fix	n/a
Red Hat Enterprise Linux 7	libarchive	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

2.77% 0.02770

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02770

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.77% (0.02770)	85.80th	v5 (v2026.06.15)
Jun 15, 2026	3.34% (0.03341)	87.04th	v5 (v2026.06.15)
Mar 30, 2025	2.29% (0.02294)	83.26th	v4 (v2025.03.14)
Mar 29, 2025	23.77% (0.23765)	93.58th	v4 (v2025.03.14)
Mar 17, 2025	2.29% (0.02294)	83.57th	v4 (v2025.03.14)
Dec 17, 2024	4.17% (0.04165)	92.11th	v3 (v2023.03.01)
Sep 3, 2023	2.06% (0.02061)	87.61th	v3 (v2023.03.01)
Mar 7, 2023	1.22% (0.01220)	83.16th	v3 (v2023.03.01)
Mar 6, 2023	1.32% (0.01319)	71.27th	v2 (v2022.01.01)
Feb 4, 2022	1.32% (0.01319)	44.98th	v2 (v2022.01.01)
Feb 3, 2022	2.26% (0.02262)	50.78th	v5 (v2026.06.15)
Apr 14, 2021	2.26% (0.02262)	0.00th	v1

Weaknesses (2)

CWE-122

CWE-125

Out-of-bounds Read

References (10)

https://access.redhat.com/security/cve/CVE-2017-14166
Vendor Advisory
https://blogs.gentoo.org/ago/2017/09/06/libarchive-heap-based-buffer-overflow-in-xml_data-archive_read_support_format_xar-c/
x_refsource_MISCPatchThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1489852
Issue Tracking
https://github.com/libarchive/libarchive/commit/fa7438a0ff4033e4741c807394a9af6207940d71
x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-14166
https://security.gentoo.org/glsa/201908-11
vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/3736-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-14166
https://www.debian.org/security/2018/dsa-4360
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2017-14166		Vendor Advisory
https://blogs.gentoo.org/ago/2017/09/06/libarchive-heap-based-buffer-overflow-in-xml_data-archive_read_support_format_xar-c/		x_refsource_MISCPatchThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1489852		Issue Tracking
https://github.com/libarchive/libarchive/commit/fa7438a0ff4033e4741c807394a9af6207940d71		x_refsource_MISCPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-14166
https://security.gentoo.org/glsa/201908-11		vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/3736-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-14166
https://www.debian.org/security/2018/dsa-4360		vendor-advisoryx_refsource_DEBIANThird Party Advisory