Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.

🗓️ 06 Apr 2022 07:00:00Reported by MicrosoftType

mscve🔗 msrc.microsoft.com👁 4 Views

Libarchive version three six zero has an out of bounds read in the zipx lzma alone init component.

Reporter	Title	Published	Views	Family All 94
IBM Security Bulletins	Security Bulletin: Vulnerabilities in GNU Binutils, Bootstrap, PortSmash, Node.js, and libarchive might affect IBM Storage Defender – Data Protect.	18 Oct 202401:50	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package libarchive version 3.6.0-alt2	26 Oct 202200:00	–	altlinux
ATTACKERKB	CVE-2022-28066	4 May 202214:15	–	attackerkb
Tenable Nessus	Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-103)	6 Sep 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-201)	4 Nov 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2023-071)	21 Mar 202300:00	–	nessus
Tenable Nessus	AlmaLinux 9 : libarchive (ALSA-2022:5252)	16 Nov 202200:00	–	nessus
Tenable Nessus	CentOS 9 : libarchive-3.5.3-2.el9	29 Feb 202400:00	–	nessus
Tenable Nessus	Debian dla-3950 : libarchive-dev - security update	12 Nov 202400:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : libarchive (EulerOS-SA-2022-2293)	14 Sep 202200:00	–	nessus

Vulners

Node

microsoft cbl2_libarchive_3.6.1-1Range<3.6.1-1

06 Apr 2022 07:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25.8

CVSS 3.16.5

EPSS0.01877

libarchive out of bounds read zipx lzma init