CVE-2017-14501 — libarchive: Out-of-bounds read in parse_file_info

Back Back to CVE browser

MEDIUM

libarchive: Out-of-bounds read in parse_file_info

Published Sep 17, 2017

6.5

MEDIUM

CVSS 3.0

EPSS 1.85%

Description

An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header.

Affected products

Red Hat Enterprise Linux 8

libarchive-0:3.3.3-1.el8

Fixed · RHEA-2021:1580
Red Hat Enterprise Linux 6

libarchive

Will not fix
Red Hat Enterprise Linux 7

libarchive

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	libarchive-0:3.3.3-1.el8	Fixed	RHEA-2021:1580
Red Hat Enterprise Linux 6	libarchive	Will not fix	n/a
Red Hat Enterprise Linux 7	libarchive	Will not fix	n/a

Remediation

Red Hat statement

Starting in Red Hat Enterprise Linux (RHEL) 8.4.0 already fixed version of the libarchive packages is shipped, therefore RHEL 8.4.0 and later versions are not affected by this vulnerability.

Metrics

1.85% 0.01851

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01851

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.85% (0.01851)	78.35th	v5 (v2026.06.15)
Jun 15, 2026	2.15% (0.02147)	79.65th	v5 (v2026.06.15)
Mar 30, 2025	0.88% (0.00878)	73.22th	v4 (v2025.03.14)
Mar 29, 2025	2.43% (0.02430)	75.19th	v4 (v2025.03.14)
Mar 17, 2025	0.88% (0.00878)	73.71th	v4 (v2025.03.14)
Dec 12, 2024	0.35% (0.00352)	72.77th	v3 (v2023.03.01)
Feb 8, 2024	0.35% (0.00352)	71.12th	v3 (v2023.03.01)
Sep 3, 2023	0.35% (0.00352)	68.39th	v3 (v2023.03.01)
Mar 7, 2023	0.39% (0.00391)	69.14th	v3 (v2023.03.01)
Mar 6, 2023	1.11% (0.01108)	55.18th	v2 (v2022.01.01)
Feb 4, 2022	1.11% (0.01108)	29.61th	v2 (v2022.01.01)
Feb 3, 2022	1.45% (0.01454)	32.67th	v5 (v2026.06.15)
Apr 14, 2021	1.45% (0.01454)	0.00th	v1

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (10)

https://access.redhat.com/security/cve/CVE-2017-14501
Vendor Advisory
https://bugs.debian.org/875966
x_refsource_MISCIssue TrackingMailing ListThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1494460
Issue Tracking
https://github.com/libarchive/libarchive/issues/949
x_refsource_MISCThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2017-14501
https://security.gentoo.org/glsa/201908-11
vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/3736-1/
vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2017-14501
https://www.debian.org/security/2018/dsa-4360
vendor-advisoryx_refsource_DEBIAN

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2017-14501		Vendor Advisory
https://bugs.debian.org/875966		x_refsource_MISCIssue TrackingMailing ListThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1494460		Issue Tracking
https://github.com/libarchive/libarchive/issues/949		x_refsource_MISCThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html		mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2017-14501
https://security.gentoo.org/glsa/201908-11		vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/3736-1/		vendor-advisoryx_refsource_UBUNTU
https://www.cve.org/CVERecord?id=CVE-2017-14501
https://www.debian.org/security/2018/dsa-4360		vendor-advisoryx_refsource_DEBIAN