Heap-based Buffer Over-read

🗓️ 19 Feb 2025 05:11:02Reported by Veracode Vulnerability DatabaseType

veracode

veracode🔗 sca.analysiscenter.veracode.com👁 3 Views

Heap-based buffer over-read in libarchive.so allows attackers to read out-of-bounds memory.

Reporter	Title	Published	Views	Family All 41
AlpineLinux	CVE-2024-57970	16 Feb 202500:00	–	alpinelinux
BDU FSTEC	The vulnerability of the header_gnu_longlink function in the archive_read_support_format_tar.c file of the Libarchive library allows a attacker to cause a service failure.	5 May 202500:00	–	bdu_fstec
Chainguard	CVE-2024-57970 vulnerabilities	19 Mar 202504:12	–	cgr
Circl	CVE-2024-57970	16 Feb 202504:15	–	circl
CNNVD	libarchive 安全漏洞	16 Feb 202500:00	–	cnnvd
CVE	CVE-2024-57970	16 Feb 202500:00	–	cve
Cvelist	CVE-2024-57970	16 Feb 202500:00	–	cvelist
Debian CVE	CVE-2024-57970	16 Feb 202500:00	–	debiancve
EUVD	EUVD-2024-53870	3 Oct 202520:07	–	euvd
Microsoft CVE	libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.	3 Sep 202522:29	–	mscve

Vulners

Node

libarchive libarchiveMatch3.7.7-r0cpp

AND

libarchive libarchiveMatch3.7.2-r0cpp

AND

libarchive libarchiveMatch3.6.2-r2cpp

AND

libarchive libarchiveMatch3.7.6-r0cpp

AND

libarchive libarchiveMatch3.7.4-r0cpp

AND

libarchive libarchiveMatch3.7.2-r1cpp

AND

libarchive libarchiveMatch3.7.5-r0cpp

AND

alpinelinux alpine_linuxMatch3.18

OR

libarchive libarchiveMatch3.6.2-r1cpp

AND

libarchive libarchiveMatch3.7.4-r0cpp

AND

libarchive libarchiveMatch3.6.2-r2cpp

AND

libarchive libarchiveMatch3.5.2-r2cpp

AND

libarchive libarchiveMatch3.6.1-r1cpp

AND

libarchive libarchiveMatch3.6.2-r3cpp

AND

libarchive libarchiveMatch3.6.1-r0cpp

AND

libarchive libarchiveMatch3.4.3-r0cpp

AND

libarchive libarchiveMatch3.4.2-r0cpp

AND

libarchive libarchiveMatch3.5.1-r0cpp

AND

libarchive libarchiveMatch3.7.6-r0cpp

AND

libarchive libarchiveMatch3.7.5-r0cpp

AND

libarchive libarchiveMatch3.7.0-r0cpp

AND

libarchive libarchiveMatch3.7.1-r0cpp

AND

libarchive libarchiveMatch3.5.2-r0cpp

AND

libarchive libarchiveMatch3.7.3-r0cpp

AND

libarchive libarchiveMatch3.7.7-r0cpp

AND

libarchive libarchiveMatch3.7.2-r1cpp

AND

libarchive libarchiveMatch3.7.2-r0cpp

AND

libarchive libarchiveMatch3.6.0-r0cpp

AND

libarchive libarchiveMatch3.6.1-r2cpp

AND

alpinelinux alpine_linuxMatchedge

OR

libarchive libarchiveMatch3.7.4-r0cpp

AND

libarchive libarchiveMatch3.7.2-r0cpp

AND

libarchive libarchiveMatch3.7.5-r0cpp

AND

libarchive libarchiveMatch3.7.7-r0cpp

AND

libarchive libarchiveMatch3.7.6-r0cpp

AND

libarchive libarchiveMatch3.7.2-r1cpp

AND

alpinelinux alpine_linuxMatch3.19

OR

libarchive libarchiveMatch3.7.7-r0cpp

AND

libarchive libarchiveMatch3.7.6-r0cpp

AND

alpinelinux alpine_linuxMatch3.21

OR

libarchive libarchiveMatch3.7.4-r0cpp

AND

libarchive libarchiveMatch3.7.3-r0cpp

AND

libarchive libarchiveMatch3.7.6-r0cpp

AND

libarchive libarchiveMatch3.7.5-r0cpp

AND

libarchive libarchiveMatch3.7.7-r0cpp

AND

alpinelinux alpine_linuxMatch3.20

OR

libarchive.so libarchive.soRange13.1.2–14cpp

Source	Link
github	www.github.com/libarchive/libarchive/issues/2415
github	www.github.com/libarchive/libarchive/pull/2422
github	www.github.com/libarchive/libarchive/commit/82912103214506316bd9990d73f33d743d55f570
github	www.github.com/advisories/GHSA-2q66-6w43-8rm9

23 Feb 2025 21:16Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.14

EPSS0.00016

SSVC

heap-based vulnerability buffer over-read libarchive vulnerability information disclosure