CVE-2016-6250

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.

• CWE-190

• http://rhn.redhat.com/errata/RHSA-2016-1844.html
• http://www.openwall.com/lists/oss-security/2016/07/20/1Release Notes
• http://www.openwall.com/lists/oss-security/2016/07/21/3Release Notes
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
• http://www.securityfocus.com/bid/92036Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036431Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1347085Issue Tracking, Third Party Advisory
• https://github.com/libarchive/libarchive/commit/3014e198Issue Tracking, Patch
• https://github.com/libarchive/libarchive/files/295073/libarchiveOverflow.txtIssue Tracking
• https://github.com/libarchive/libarchive/issues/711Issue Tracking, Patch
• https://security.gentoo.org/glsa/201701-03
• http://rhn.redhat.com/errata/RHSA-2016-1844.html
• http://www.openwall.com/lists/oss-security/2016/07/20/1Release Notes
• http://www.openwall.com/lists/oss-security/2016/07/21/3Release Notes
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlThird Party Advisory
• http://www.securityfocus.com/bid/92036Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036431Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1347085Issue Tracking, Third Party Advisory
• https://github.com/libarchive/libarchive/commit/3014e198Issue Tracking, Patch
• https://github.com/libarchive/libarchive/files/295073/libarchiveOverflow.txtIssue Tracking
• https://github.com/libarchive/libarchive/issues/711Issue Tracking, Patch
• https://security.gentoo.org/glsa/201701-03

Published

Sep 21, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6243thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows …
• CVE-2016-6244The sys_thrsigdivert function in kern/kern_sig.c in the Open…
• CVE-2016-6245OpenBSD 5.8 and 5.9 allows local users to cause a denial of …
• CVE-2016-6246OpenBSD 5.8 and 5.9 allows certain local users with kern.use…
• CVE-2016-6247OpenBSD 5.8 and 5.9 allows certain local users to cause a de…
• CVE-2016-6249F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which tim…
• CVE-2016-6251Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-6252Integer overflow in shadow 4.2.1 allows local users to gain …
• CVE-2016-6253mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through…
• CVE-2016-6254Heap-based buffer overflow in the parse_packet function in n…
• CVE-2016-6255Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote …
• CVE-2016-6256SAP Business One for Android 1.2.3 allows remote attackers t…