list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

🗓️ 19 Mar 2025 07:00:00Reported by MicrosoftType

Libarchive tar ignores strftime result, enabling denial of service with crafted archives at verbose level.

Reporter	Title	Published	Views	Family All 137
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues	28 Aug 202521:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	6 Aug 202516:37	–	ibm
IBM Security Bulletins	Security Bulletin: Watsonx BI is affected by the use of Insufficiently Random Values causing a vulnerability in form-data allowing HTTP Parameter Pollution (HPP)	17 Sep 202517:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	23 Jul 202517:22	–	ibm
Tenable Nessus	AlmaLinux 10 : libarchive (ALSA-2025:9420)	9 Oct 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : libarchive (ALSA-2025:9431)	30 Jun 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: libarchive (CVE-2025-25724)	10 Apr 202500:00	–	nessus
Tenable Nessus	CentOS 9 : libarchive-3.5.3-5.el9	11 Jun 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2025-1591)	11 Jun 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2025-1592)	11 Jun 202500:00	–	nessus