JLSEC-2025-246 A vulnerability has been identified in the libarchive library

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber LZSS window. This means the library may attempt to read beyond the allocated memory buffer, which can...

PT-2025-55098

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the...

PT-2025-55097

libarchive 3.4.1 through 3.5.1 has a use-after-free in copy string called from do uncompress block and process block...

PT-2025-55100

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the publi...

PT-2025-55099

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask call inside archive write disk posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race...

PT-2025-55408

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber LZSS window. This means the library may attempt to read beyond the allocated memory buffer, which can...

PT-2025-55101

Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header pax extension at rchive read support format tar.c:1844:8...

PT-2025-55409

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memo...

PT-2025-55407

execute filter audio in archive read support format rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst...

Slackware: Security Advisory (SSA:2025-322-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] libarchive

New libarchive packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libarchive-3.8.3-i586-1slack15.0.txz: Upgraded. This update contains security fixes and improvements: lib: Create temporary files ...

Slackware Linux 15.0 / current libarchive Vulnerability (SSA:2025-322-01)

The version of libarchive installed on the remote host is prior to 3.8.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-322-01 advisory. New libarchive packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

Photon OS 5.0: Libarchive PHSA-2025-5.0-0672

An update of the libarchive package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0672. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Debian: Security Advisory (DLA-4368-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4368-1] libarchive security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4368-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 11, 2025 https://wiki.debian.org/LTS -...

An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).

...

DLA-4368-1 libarchive - security update

Bulletin has no description...

Debian dla-4368 : libarchive-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4368 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4368-1 [email protected]...

Advisory ROSA-SA-2025-3071

Software: libarchive 3.3.3 OS: ROSA Virtualization 3.0 unaffected versions = libarchive-3.3.3.3-6.0.1.rv30 affected versions libarchive-3.3.3.3-6.0.1.rv30 CVE-ID: CVE-2025-5914 BDU-ID: CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the archivereadformatrarseekdata function of the Libarchive...

Advisory ROSA-SA-2025-3063

Software: libarchive 3.3.3 OS: ROSA Virtualization 2.1 unaffected versions = libarchive-3.3.3.3-6.0.1.rv3 affected versions libarchive-3.3.3.3-6.0.1.rv3 CVE-ID: CVE-2025-5914 BDU-ID: CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the archivereadformatrarseekdata function of the Libarchive...