CVE-2024-20696

libarchive-harness-win - CVE-2024-20696 Entrada de blog: https://clearbluejar.github.io/posts/patch-tuesday-diffing-cve-2024-20696-windows-libarchive-rce/ Un sencillo banco de pruebas para CVE-2024-20696 1. Descargue una versión de archiveint.dll que desee probar 2. Actualice la ruta aquí 3...

CVE-2024-55587

CVE-2024-55587 Este repositorio es una prueba de concepto para la vulnerabilidad CVE-2024-55587 en la biblioteca Python libarchive. El archivo generatezip crea un zip malicioso que explotará la extracción insegura de archivos en el método extractall de libarchive. El archivo vulnerablezip es solo...

cve-2025-5915

CVE-2025-5915 — lectura fuera de límites de heap en RAR v4 de libarchive con prueba en dispositivo iOS 18.5 Una lectura fuera de límites de heap / divulgación de memoria controlada en la ruta del filtro RAR v4 de libarchive copyfromlzsswindow. Este repositorio la reproduce de principio a fin: ASa...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.71 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.71 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2025-59284-PoC

CVE-2025-59284-PoC Proof of concept for CVE-2025-59284 libarchive exploit usage: root@kitploit: Usage: Poc.py e.g python poc.py test.pdf '\IP\Share\test.pdf' pdf.tar Technical writeup: https://sec-fault.com/blog/cve-2025-59284/ Video...

AlmaLinux 10 : libarchive (ALSA-2026:69553)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69553 advisory. libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header CVE-2026-15028 libarchive: libarchive: Signed Integer...

libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header

A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation cou...

libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archivewritezipheader function in archivewritesetformatzip.c, when ZIP encryption is enabled and the entry file size is close to INT64MAX, the addition of the encryption overhead to the entry size overflows int64...

Low: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0  by vulnerabilities in nghttp2 and libarchive

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include open-source packages nghttp2 and libarchive that are affected by three high-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Detail...

ALSA-2026:69553 Low: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

EulerOS Virtualization 2.12.0 : libarchive (EulerOS-SA-2026-3646)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the...

EulerOS Virtualization 2.11.1 : libarchive (EulerOS-SA-2026-3426)

According to the versions of the libarchive packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial o...

EulerOS Virtualization 2.12.1 : libarchive (EulerOS-SA-2026-3592)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the...

EulerOS Virtualization 2.11.0 : libarchive (EulerOS-SA-2026-3513)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of...

Linux Distros Unpatched Vulnerability : CVE-2025-64031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original- filename field to archivecompressorgzipopen in...

Astra Linux – Vulnerability in libarchive

A issue was discovered in libarchive bsdtar before version 3.8.1, in the function applysubstitution in the file tar/subst.c, when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to a denial of service Out-of-Memory crash...

Astra Linux – Vulnerability in libarchive

An improper link resolution flaw during the extraction of an archive can cause changes to the access control list ACL of the target of the link. An attacker may provide a malicious archive to a victim user, triggering this flaw when the victim tries to extract the archive. A local attacker may...

Astra Linux – Vulnerability in libarchive

In libarchive versions 3.4.1 through 3.5.1, there is a use-after-free in the copystring function called from douncompressblock and processblock...

Astra Linux – Vulnerability in libarchive

“executefilteraudio” in “archivereadsupportformatrar.c” in “libarchive” before version 3.7.5 allows out-of-bounds access via a crafted archive file, as “src” can move beyond “dst”...