CVE-2022-26280: Medium severity Libarchive libarchive vulnerability
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipxlzmaaloneinit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/libarchiveto a version that resolves this vulnerability.Fixed in 3.6.1-r0 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.6.2-1 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.6.2-1+deb12u4Fixed in 3.6.2-1+deb12u5Fixed in 3.7.4-4+deb13u1Fixed in 3.8.10-2 - Upgrade
Upgrade
redhat/libarchiveto a version that resolves this vulnerability.Fixed in 3.6.1
Event History
Frequently Asked Questions
What is CVE-2022-26280?
CVE-2022-26280 is a vulnerability discovered in Libarchive v3.6.0 that allows an out-of-bounds read via the component zipx_lzma_alone_init.
What is the severity of CVE-2022-26280?
CVE-2022-26280 has a severity rating of 6.5 (medium).
How does CVE-2022-26280 affect Libarchive?
CVE-2022-26280 affects Libarchive v3.6.0.
How can I fix CVE-2022-26280?
To fix CVE-2022-26280, it is recommended to update Libarchive to a version that is not affected.
Where can I find more information about CVE-2022-26280?
More information about CVE-2022-26280 can be found in the references provided: [1] [2] [3].