Astra Linux – Vulnerability in libarchive

A issue was discovered in libarchive bsdtar before version 3.8.1, in the function applysubstitution in the file tar/subst.c, when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to a denial of service Out-of-Memory crash...

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

UBUNTU-CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

CVE-2025-64031

libarchive versions 3.8.x before 3.8.2 (affecting bsdtar ) contain a strcpy heap-based buffer overflow in the gzip writer, triggered via the original-filename field passed to archive_compressor_gzip_open in archive_write_add_filter_gzip.c. The CVSS 3.1 score is 2.5 (Low) with a local attack vecto...

EUVD-2025-210902

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

PT-2026-90992

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive compressor gzip open in archive write add filter gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in...

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

CVE-2025-64031

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archivecompressorgzipopen in archivewriteaddfiltergzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which...

Astra Linux – Vulnerability in libarchive

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are passed into bsdtar, potentially allowing for reading beyond the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior,...

RHEL 10 : libarchive (RHSA-2026:52675)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52675 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libarchive: bsdcat-3.8.8-3.1.hum1 aarch64, x8664 bsdcpio-3.8.8-3.1.hum1 aarch64, x8664 bsdtar-3.8.8-3.1.hum1 aarch64, x8664 bsdunzip-3.8.8-3.1.hum1 aarch64, x8664 libarchive-3.8.8-3.1.hum1 aarch6...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libarchive: bsdcat-3.8.8-2.hum1 aarch64, x8664 bsdcpio-3.8.8-2.hum1 aarch64, x8664 bsdtar-3.8.8-2.hum1 aarch64, x8664 bsdunzip-3.8.8-2.hum1 aarch64, x8664 libarchive-3.8.8-2.hum1 aarch64, x8664...

EulerOS Virtualization 2.13.0 : libarchive (EulerOS-SA-2026-2172)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An issue was discovered in libarchive bsdtar before version 3.8.1 in function applysubstitution in file tar/subst.c when...

EulerOS Virtualization 2.13.1 : libarchive (EulerOS-SA-2026-2133)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An issue was discovered in libarchive bsdtar before version 3.8.1 in function applysubstitution in file tar/subst.c when...

CLSA-2026-1778894153 libarchive: Fix of CVE-2025-60753

CVE-2025-60753: denial of service in bsdtar -s substitution when the regular expression matches a zero-length string, causing an infinite loop in applysubstitution...

CLSA-2026-1778893359 libarchive: Fix of CVE-2025-60753

CVE-2025-60753: denial of service in bsdtar -s substitution when the regular expression matches a zero-length string, causing an infinite loop in applysubstitution...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libarchive (UTSA-2026-016794)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016794 advisory. An issue was discovered in libarchive bsdtar before version 3.8.1 in function applysubstitution in file tar/subst.c when processing crafted -s substitution rules. Th...