CVE-2015-8931

Name: CVE-2015-8931
Creator: NVD / NIST
Published: 2016-09-20T14:15:18.04+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.13%

Last modified Jun 17, 2026

CVE-2015-8931 is a vulnerability of currently unknown severity. Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.. EPSS estimates a 2.13% chance of exploitation in the next 30 days.

Description

Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.

Metrics

EPSS Probability

2.13%

79.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-190

Affected Software

Vendor	Product	Versions	Update
Libarchive	Libarchive	<= 3.1.901a	—
Suse	Linux Enterprise Desktop	12	Sp1
Suse	Linux Enterprise Server	12	Sp1
Suse	Linux Enterprise Software Development Kit	12	Sp1
Canonical	Ubuntu Linux	12.04	—
Canonical	Ubuntu Linux	14.04	—
Canonical	Ubuntu Linux	15.10	—
Canonical	Ubuntu Linux	16.04	—
Debian	Debian Linux	7.0	—
Debian	Debian Linux	8.0	—

References

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1844.html
http://www.debian.org/security/2016/dsa-3657
http://www.openwall.com/lists/oss-security/2016/06/17/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/17/5Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.securityfocus.com/bid/91338
http://www.ubuntu.com/usn/USN-3033-1Third Party Advisory
https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.htmlThird Party Advisory
https://github.com/libarchive/libarchive/issues/539Exploit, Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2015-8931Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201701-03
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1844.html
http://www.debian.org/security/2016/dsa-3657
http://www.openwall.com/lists/oss-security/2016/06/17/2Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/06/17/5Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.securityfocus.com/bid/91338
http://www.ubuntu.com/usn/USN-3033-1Third Party Advisory
https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.htmlThird Party Advisory
https://github.com/libarchive/libarchive/issues/539Exploit, Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2015-8931Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201701-03

Timeline

Published: Sep 20, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2015-8931?

How severe is CVE-2015-8931?

Severity scoring for CVE-2015-8931 is pending analysis. The EPSS model estimates a 2.13% probability of exploitation in the next 30 days.

How do I fix CVE-2015-8931?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-8931?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST