CVE-2024-37407: Critical severity oracle libarchive vulnerability
Published Jun 8, 2024
·Updated
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurpcentraldirectory in archivereadsupportformatzip.c.
Affected Software
1 affected component
Libarchive libarchive=3.7.3
Remediation
Patch Available
Event History
Jun 8, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:15 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2024-37407?
CVE-2024-37407 is considered a medium severity vulnerability due to potential name out-of-bounds access.
2
How do I fix CVE-2024-37407?
To fix CVE-2024-37407, upgrade to Libarchive version 3.7.4 or later.
3
What causes the vulnerability CVE-2024-37407?
CVE-2024-37407 is caused by an empty-name file in a ZIP archive while mac-ext is enabled.
4
Which versions of Libarchive are affected by CVE-2024-37407?
Libarchive versions before 3.7.4 are affected by CVE-2024-37407.
5
Where does CVE-2024-37407 occur in the code?
CVE-2024-37407 occurs in the slurp_central_directory function in archive_read_support_format_zip.c.