CVE-2017-14501

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-09-17 · updated 2026-06-17
Weakness: CWE-125

Description

An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header.

Affected products

libarchive: 3.3.2

References

https://bugs.debian.org/875966
https://github.com/libarchive/libarchive/issues/949
https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
https://security.gentoo.org/glsa/201908-11
https://usn.ubuntu.com/3736-1/
https://www.debian.org/security/2018/dsa-4360
https://bugs.debian.org/875966
https://github.com/libarchive/libarchive/issues/949
https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html
https://security.gentoo.org/glsa/201908-11
https://usn.ubuntu.com/3736-1/
https://www.debian.org/security/2018/dsa-4360

Get alerted when CVE-2017-14501 or the next vulnerability affects your stack