REDHAT-BUG-2349221: Medium severity Libarchive libarchive vulnerability

Q: What conditions are required for exploitation?

An attacker needs to supply a crafted TAR archive that is processed by libarchive with a verbose value of 2. The issue is associated with date formatting in list_item_verbose, and a custom locale can make the 100-byte buffer insufficient.

Q: Which deployments should be prioritized for review?

Prioritize systems that process TAR archives from untrusted sources while using verbose level 2. The affected code is in libarchive through version 3.7.7.

Published Mar 2, 2025

Updated

listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Affected Software

1 affected component

Libarchive libarchive<=3.7.7

Event History

Mar 2, 2025

Data Sourced

via Red Hat·02:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs to supply a crafted TAR archive that is processed by libarchive with a verbose value of 2. The issue is associated with date formatting in list_item_verbose, and a custom locale can make the 100-byte buffer insufficient.

Which deployments should be prioritized for review?

Prioritize systems that process TAR archives from untrusted sources while using verbose level 2. The affected code is in libarchive through version 3.7.7.

REDHAT-BUG-2349221: Medium severity Libarchive libarchive vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments should be prioritized for review?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which deployments should be prioritized for review?