Priority MEDIUM 46
libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9.
CVSS 3.1LOW 2.5· Local · No auth · User interaction · EPSS 0.0016 · Published 2026-09-14 · Partial fix · 3.8.2 CWE-122
Priority LOW 24
A flaw was found in libarchive.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00167 · Published 2026-04-07 · Partial fix · 3.8.7-1.hum1 CWE-476
Priority MEDIUM 51
A flaw was found in libarchive.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01092 · Published 2026-03-30 · Partial fix · 3.1.2-14.el7_9.2, 3.3.3-7.el8_10 +51 CWE-190
Priority LOW 29
A flaw was found in libarchive.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00317 · Published 2026-03-19 · Partial fix · 3.8.7-1.hum1 CWE-1335
Priority MEDIUM 41
A flaw was found in libarchive.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01287 · Published 2026-03-19 · Partial fix · 3.7.7-8.el10_1, 3.7.7-5.el10_0 +54 CWE-125
Priority MEDIUM 58
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00206 · Published 2025-11-05 · Partial fix CWE-400
Priority HIGH 67
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00491 · Published 2025-06-09 · Partial fix · 3.8.0, 3.7.7-4.el10_0 +48 CWE-190
Priority LOW 29
A vulnerability has been identified in the libarchive library.
CVSS 3.1MEDIUM 6.6· Local · Low privileges · User interaction · EPSS 0.00393 · Published 2025-06-09 · Partial fix · 3.8.0 CWE-125
Priority LOW 22
A vulnerability has been identified in the libarchive library.
CVSS 3.1MEDIUM 5.0· Local · Low privileges · User interaction · EPSS 0.00235 · Published 2025-06-09 · Partial fix · 3.8.0 CWE-787
Priority LOW 25
A vulnerability has been identified in the libarchive library.
CVSS 3.1MEDIUM 5.6· Local · Low privileges · User interaction · EPSS 0.00221 · Published 2025-06-09 · Partial fix · 3.8.0 CWE-190
Priority LOW 29
A vulnerability has been identified in the libarchive library.
CVSS 3.1MEDIUM 6.6· Local · Low privileges · User interaction · EPSS 0.00205 · Published 2025-06-09 · Partial fix · 3.8.0 CWE-122
Priority HIGH 66
Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00543 · Published 2025-03-28 · Will not fix CWE-476
Priority LOW 34
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00367 · Published 2025-03-02 · Partial fix CWE-252
Priority MEDIUM 55
A vulnerability was found in libarchive up to 3.7.7.
CVSS 4.0MEDIUM 4.8· Local · Low privileges · No interaction · EPSS 0.00342 · Published 2025-02-24 · No fix listed CWE-404
Priority LOW 18
libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.
CVSS 3.1MEDIUM 4.0· Local · No auth · No interaction · EPSS 0.0025 · Published 2025-02-16 · Partial fix CWE-126
Priority LOW 37
execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00552 · Published 2024-10-10 · No fix listed CWE-125
Priority LOW 37
execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0051 · Published 2024-10-10 · No fix listed CWE-125
Priority HIGH 72
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00971 · Published 2024-06-08 · No fix listed CWE-125
Priority HIGH 76
Libarchive Remote Code Execution Vulnerability
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.87896 · Published 2024-04-09 · Fixed in 10.0.22621.3447, 10.0.22631.3447 +1 CWE-122
Priority LOW 23
Libarchive through 3.6.2 can cause directories to have world-writable permissions.
CVSS 3.1MEDIUM 5.3· Local · Low privileges · No interaction · EPSS 0.00194 · Published 2023-05-29 · No fix listed CWE-362
Priority MEDIUM 54
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02457 · Published 2022-11-22 · Partial fix CWE-476
Priority LOW 34
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0039 · Published 2022-08-23 · Partial fix CWE-59
Priority LOW 34
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00392 · Published 2022-08-23 · Partial fix CWE-59
Priority LOW 33
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01877 · Published 2022-03-28 · Fixed CWE-125
Priority LOW 34
libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02845 · Published 2021-07-20 · No fix listed CWE-416
Load more
THREATIST.IORead the docs