All errata/c10f2/ALT-PU-2025-6648-3
ALT-PU-2025-6648-3

Package update libarchive in branch c10f2

Version3.7.9-alt1
Task#384126
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (6)

BDU:2025-05203
LOW3.3

Уязвимость файла bsdunzip.c библиотеки Libarchive, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2025-05-05Modified: 2026-01-27
CVSS 3.xLOW 3.3
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:P
References
BDU:2025-05210
MEDIUM4.0

Уязвимость функции list_item_verbose() библиотеки Libarchive, позволяющая нарушителю выполнить произвольный код на целевой системе

Published: 2025-05-05Modified: 2026-01-27
CVSS 3.xMEDIUM 4.0
CVSS:3.x/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 2.0LOW 2.6
CVSS:2.0/AV:L/AC:H/Au:N/C:N/I:P/A:P
References
BDU:2025-10856
HIGH7.5

Уязвимость функции header_pax_extension компонента rchive_read_support_format_tar.c:1844:8 библиотеки архивирования Libarchive, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2025-09-08Modified: 2026-01-27
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
CVE-2025-1632
MEDIUM4.8

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2025-02-24Modified: 2025-03-25
CVSS 2.0LOW 1.7
CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:N/A:P
CVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 4.0MEDIUM 4.8
CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
CVE-2025-25724
HIGH7.8

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Published: 2025-03-02Modified: 2025-07-17
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References