RHEL 9 : libarchive (RHSA-2025:15024)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15024 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM...

macOS 26.x < 26.2 Multiple Vulnerabilities (125886)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.2. It is, therefore, affected by multiple vulnerabilities: - A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing fo...

macOS 15.x < 15.7.3 Multiple Vulnerabilities (125887)

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.7.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing...

macOS 14.x < 14.8.3 Multiple Vulnerabilities (125888)

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.8.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing...

OESA-2025-2787 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

OESA-2025-2786 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

OESA-2025-2785 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

CLSA-2025-1764778336 libarchive: Fix of 2 CVEs

CVE-2025-5917: fix overflow in buildustarentry - CVE-2025-5918: do not skip past EOF while reading...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.103084)

The version of AHV installed on the remote host is prior to 20230302.103084. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.103084 advisory. - A vulnerability has been identified in the libarchive library, specifically within the...

OESA-2025-2761 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

OESA-2025-2762 libarchive security update

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...

CLSA-2025-1764235944 libarchive: Fix of CVE-2025-25724

CVE-2025-25724: fix buffer overflow vulnerability in libarchive...

JLSEC-2025-248 A vulnerability has been identified in the libarchive library

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive WARC file that claims to have more than INT64MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow,...

JLSEC-2025-237 In libarchive before 3.6.2, the software does not check for an error after calling calloc function...

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the...

JLSEC-2025-246 A vulnerability has been identified in the libarchive library

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber LZSS window. This means the library may attempt to read beyond the allocated memory buffer, which can...

JLSEC-2025-239 Libarchive Remote Code Execution Vulnerability

Libarchive Remote Code Execution Vulnerability...

JLSEC-2025-244 Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar...

Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function headerpaxextension at rchivereadsupportformattar.c:1844:8...

JLSEC-2025-249 A vulnerability has been identified in the libarchive library

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

JLSEC-2025-240 `execute_filter_audio` in `archive_read_support_format_rar.c` in libarchive before 3.7.5 allows...

executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst...

JLSEC-2025-234 libarchive 3.4.1 through 3.5.1 has a use-after-free in `copy_string` (called from...

libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring called from douncompressblock and processblock...