Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4hvy-whmq-53ft
Vulnerability ID VCID-4hvy-whmq-53ft
Aliases CVE-2015-8928
Summary The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-228 Improper Handling of Syntactically Invalid Structure
CWE-125 Out-of-bounds Read
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8928.json
epss 0.00295 https://api.first.org/data/v1/epss?cve=CVE-2015-8928
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8928.json
https://api.first.org/data/v1/epss?cve=CVE-2015-8928
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8916
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8917
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8919
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8921
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8922
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8923
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8924
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8925
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8926
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8928
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8930
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8931
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8932
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8933
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8934
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4300
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4302
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5844
1348429 https://bugzilla.redhat.com/show_bug.cgi?id=1348429
GLSA-201701-03 https://security.gentoo.org/glsa/201701-03
RHSA-2016:1844 https://access.redhat.com/errata/RHSA-2016:1844
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8928.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.53023
EPSS Score 0.00295
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:40:02.768481+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.6.0