CVE-2017-14166: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 2.8% chance of exploitation in the next 30 days.

libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Libarchive Libarchive: version 3.3.2 only

Published 2017-09-06. Last modified 2026-06-17.