In libarchive before 3.6.2 the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances when NULL is equivalent to the 0x0 memory address and privileged code can access it then writing or reading memory is possible which may lead to code execution."

🗓️ 29 Nov 2022 08:00:00Reported by MicrosoftType

Libarchive before 3.6.2 does not check calloc error, risking NULL dereference and code execution.

Reporter	Title	Published	Views	Family All 160
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from openssl-libs, libssh, libarchive, sqlite and go-toolset	1 Aug 202306:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in libarchive (CVE-2022-36227)	27 Jul 202317:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	12 Sep 202319:10	–	ibm
Tenable Nessus	Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2023-246)	20 Jul 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : libarchive (ALAS-2023-2279)	5 Oct 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : libarchive (ALAS-2023-2364)	4 Dec 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0148: libarchive (ALINUX3-SA-2023:0148)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : libarchive (ALSA-2023:2532)	14 May 202300:00	–	nessus
Tenable Nessus	AlmaLinux 8 : libarchive (ALSA-2023:3018)	20 May 202300:00	–	nessus