Product:

Libarchive

(Libarchive)
Repositories https://github.com/libarchive/libarchive
#Vulnerabilities 64
Date Id Summary Products Score Patch Annotated
2025-06-09 CVE-2025-5914 A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition. Libarchive, Enterprise_linux, Openshift_container_platform 9.8
2024-06-08 CVE-2024-37407 Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c. Libarchive 9.1
2023-05-29 CVE-2023-30571 Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories. Libarchive 5.3
2024-04-09 CVE-2024-26256 Libarchive Remote Code Execution Vulnerability Fedora, Libarchive, Windows_11_22h2, Windows_11_23h2, Windows_server_2022_23h2 N/A
2024-10-10 CVE-2024-48957 execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst. Libarchive 7.8
2024-10-10 CVE-2024-48958 execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst. Libarchive 7.8
2020-02-20 CVE-2020-9308 archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact. Ubuntu_linux, Fedora, Libarchive 8.8
2020-10-15 CVE-2020-21674 Heap-based buffer overflow in archive_string_append_from_wcs() (archive_string.c) in libarchive-3.4.1dev allows remote attackers to cause a denial of service (out-of-bounds write in heap memory resulting into a crash) via a crafted archive file. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected. Libarchive 6.5
2021-07-20 CVE-2021-36976 libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). Ipados, Iphone_os, Macos, Watchos, Fedora, Libarchive, Universal_forwarder 6.5
2022-03-28 CVE-2022-26280 Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init. Fedora, Libarchive 6.5