JLSEC-2025-249 A vulnerability has been identified in the libarchive library

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

JLSEC-2025-240 `execute_filter_audio` in `archive_read_support_format_rar.c` in libarchive before 3.7.5 allows...

executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst...

JLSEC-2025-247 A vulnerability has been identified in the libarchive library

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to...

JLSEC-2025-238 Libarchive through 3.6.2 can cause directories to have world-writable permissions

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask call inside archivewritediskposix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race...

JLSEC-2025-244 Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar...

Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function headerpaxextension at rchivereadsupportformattar.c:1844:8...

JLSEC-2025-234 libarchive 3.4.1 through 3.5.1 has a use-after-free in `copy_string` (called from...

libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring called from douncompressblock and processblock...

JLSEC-2025-245 A vulnerability has been identified in the libarchive library, specifically within the...

A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enablin...

JLSEC-2025-243 `list_item_verbose` in `tar/util.c` in libarchive through 3.7.7 does not check an strftime return...

listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custo...

JLSEC-2025-250 libarchive through 3.7.7 has a heap-based buffer over-read in `header_gnu_longlink` in...

libarchive through 3.7.7 has a heap-based buffer over-read in headergnulonglink in archivereadsupportformattar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname...

JLSEC-2025-242 A vulnerability was found in libarchive up to 3.7.7

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the publi...

Slackware: Security Advisory (SSA:2025-322-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] libarchive

New libarchive packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libarchive-3.8.3-i586-1slack15.0.txz: Upgraded. This update contains security fixes and improvements: lib: Create temporary files ...

Slackware Linux 15.0 / current libarchive Vulnerability (SSA:2025-322-01)

The version of libarchive installed on the remote host is prior to 3.8.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-322-01 advisory. New libarchive packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

Photon OS 5.0: Libarchive PHSA-2025-5.0-0672

An update of the libarchive package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0672. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Debian: Security Advisory (DLA-4368-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4368-1] libarchive security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4368-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 11, 2025 https://wiki.debian.org/LTS -...

An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).

...

DLA-4368-1 libarchive - security update

Bulletin has no description...

Debian dla-4368 : libarchive-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4368 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4368-1 [email protected]...

Advisory ROSA-SA-2025-3071

Software: libarchive 3.3.3 OS: ROSA Virtualization 3.0 unaffected versions = libarchive-3.3.3.3-6.0.1.rv30 affected versions libarchive-3.3.3.3-6.0.1.rv30 CVE-ID: CVE-2025-5914 BDU-ID: CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the archivereadformatrarseekdata function of the Libarchive...