CVE-2024-48957: High severity Libarchive libarchive vulnerability
executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/libarchiveto a version that resolves this vulnerability.Fixed in 3.7.5-r0 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.6.2-1+deb12u1 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.7.2-2.1 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.6.2-1+deb12u4Fixed in 3.6.2-1+deb12u5Fixed in 3.7.4-4+deb13u1Fixed in 3.8.9-1Fixed in 3.8.10-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48957?
CVE-2024-48957 has a medium severity level due to the potential for out-of-bounds access.
How do I fix CVE-2024-48957?
To mitigate CVE-2024-48957, upgrade to libarchive version 3.7.5 or later.
What types of applications are affected by CVE-2024-48957?
CVE-2024-48957 affects applications that utilize libarchive versions prior to 3.7.5 for processing RAR archive files.
Can CVE-2024-48957 be exploited remotely?
Yes, CVE-2024-48957 can potentially be exploited by an attacker through a crafted archive file.
What specific function is involved in CVE-2024-48957?
CVE-2024-48957 is associated with the execute_filter_audio function in archive_read_support_format_rar.c in libarchive.