CVE-2016-6250

Name	CVE-2016-6250
Description	Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-554-1, DSA-3677-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libarchive (PTS)	bullseye	3.4.3-2+deb11u1	fixed
	bookworm, bookworm (security)	3.6.2-1+deb12u1	fixed
	sid, trixie	3.7.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
libarchive	source	wheezy	3.0.4-3+wheezy2		DLA-554-1
libarchive	source	jessie	3.1.2-11+deb8u3		DSA-3677-1
libarchive	source	(unstable)	3.2.1-1	low

Notes

https://github.com/libarchive/libarchive/issues/711
Fixed by: https://github.com/libarchive/libarchive/commit/3014e19820ea53c15c90f9d447ca3e668a0b76c6 (v3.2.1)
https://www.openwall.com/lists/oss-security/2016/07/20/1