CVE-2024-20696

libarchive-harness-win - CVE-2024-20696 Blogbeitrag: https://clearbluejar.github.io/posts/patch-tuesday-diffing-cve-2024-20696-windows-libarchive-rce/ Ein einfacher Test-Harness für CVE-2024-20696 1. Laden Sie eine Version von archiveint.dll herunter, die Sie testen möchten 2. Aktualisieren Sie d...

CVE-2024-55587

CVE-2024-55587 Dieses Repository ist ein Proof of Concept für die Sicherheitslücke CVE-2024-55587 in der Python-Bibliothek libarchive. Die Datei generatezip erstellt eine bösartige Zip-Datei, die die unsichere Extraktion von Dateien in der extractall-Methode von libarchive ausnutzt. Die Datei...

CVE-2025-59284-PoC

CVE-2025-59284-PoC Prova de conceito para o exploit CVE-2025-59284 no libarchive uso: root@kitploit: Usage: Poc.py exemplo python poc.py test.pdf '\IP\Share\test.pdf' pdf.tar Artigo técnico: https://sec-fault.com/blog/cve-2025-59284/ Vídeo...

RHBA-2022:3897 Red Hat Bug Fix Advisory: new packages: libarchive

Bulletin has no description...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

cve-2025-5915

CVE-2025-5915 — libarchive RAR-v4-Heap-Over-Read mit On-Device-Beweis unter iOS 18.5 Ein kontrollierter Heap-Over-Read / Memory-Disclosure im RAR-v4-Filterpfad von libarchive copyfromlzsswindow. Dieses Repository reproduziert das Problem Ende-zu-Ende: lokales ASan, ein von Grund auf neu...

ROOT-OS-DEBIAN-11-CVE-2025-5914 CVE-2025-5914 in libarchive - Patched by Root

Root has patched CVE-2025-5914 in the libarchive package for Root:Debian:11. Multiple fixed versions available...

RHSA-2026:56954 Red Hat Security Advisory: libarchive security update

Bulletin has no description...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

CVE-2026-19671

Malcolm's safe-extract.py enforces decompression limits only on container archives (zip/tar/rar/7z) but not on single-stream formats (.gz/.xz/.lzma/.lz). An authenticated user can upload a small gzip bomb that decompresses unboundedly, exhausting the shared Docker volume used by OpenSearch, Logst...

Security Bulletin: IBM Financial Transaction Manager v4.0.6.0 is impacted by multiple vulnerabilities in RedHat Universal Base Image

Summary IBM Financial Transaction Manager v4.0.6.0 has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-5914 DESCRIPTION: A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata function. This flaw involves a...

DEBIAN-CVE-2026-74505

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a...

DEBIAN-CVE-2026-72431

In the Linux kernel, the following vulnerability has been resolved: alloctag: fix use-after-free in /proc/allocinfo after module unload allocinfostart only reinitializes the codetag iterator at position 0. For subsequent reads position 0, it reuses cached iterator state from the previous batch...