A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

Last updated 23 April 2025

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A double-free vulnerability exists in the libarchive RAR5 reader subsystem within archivereadsupportformatrar5.c where the state tracking pointer rar->cstate.filteredbuf can be linked to a temporary filter output block during archive decompression. When the unpacking engine subsequently processes an adjacent file or resets its internal state layout via initunpack(), it releases the allocation mapped to filteredbuf but fails to clear or nullify the underlying pointer variable. A specially crafted RAR5 archive can exploit this lingering dangling pointer by forcing a secondary release operation on the exact same memory address, triggering a standard memory-manager abort that immediately crashes the application and results in a Denial of Service (DoS).

In libarchive before 3.8.0, an integer overflow in the archivereadformatrarseekdata() function may lead to a double free problem.

A Heap Out-of-Bounds Read vulnerability exists in the RAR archive processing logic of the libarchive library. The issue arises from improper validation of the LZSS sliding window size after transitions between compression methods (PPMd and LZSS). Due to a mismatch between the allocated buffer size and the expected dictionary size, the copyfromlzsswindow() function performs out-of-bounds memory reads. This allows a specially crafted RAR archive to leak heap memory through the archivereaddata() API before integrity checks (CRC) are enforced. The vulnerability can be exploited remotely without authentication or user interaction in systems that automatically process archives, leading to disclosure of sensitive information.

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

On 32-bit systems, an integer overflow in the zisofs block pointer allocation logic (archivereadsupportformatiso9660.c, line 1537) wraps the allocation size to zero. malloc(0) returns a ~16-byte buffer, but the code records the un-wrapped size (~4 GB) and proceeds to memcpy() attacker-controlled ISO data into the tiny buffer - a heap buffer overflow WRITE. On 64-bit systems the overflow doesn't wrap and malloc fails safely. Shares root cause with vulnerability #2 (unvalidated pzlog2bs).Requirements to exploit: The target must be a 32-bit system processing a crafted ISO9660 image via libarchive. The attacker needs to deliver the ISO to an application that extracts or reads its contents. Exploitation to RCE would require heap grooming specific to the target allocator/platform.

A signed integer overflow flaw was found in libarchive's ZIP writer. The issue occurs in the archivewritezipheader function in archivewritesetformatzip.c when writing a ZIP entry with a known file size while ZIP encryption (e.g., AES-256) is enabled. When the entry size is close to INT64MAX, adding the encryption overhead (additionalsize) to zip->entryuncompressedsize triggers a signed integer overflow, leading to undefined behavior per the C standard. This could result in incorrect Zip64 extension decisions or potential memory corruption.

The vulnerability is in the write path only and requires both ZIP encryption to be enabled and a file size near INT64MAX, making real-world exploitation unlikely.

Upstream issue: https://github.com/libarchive/libarchive/issues/3225 Upstream fix: https://github.com/libarchive/libarchive/pull/3228

A signed integer overflow flaw was found in libarchive's ZIP writer. The issue occurs in the archivewritezipheader function in archivewritesetformatzip.c when writing a ZIP entry with a known file size while ZIP encryption (e.g., AES-256) is enabled. When the entry size is close to INT64MAX, adding the encryption overhead (additionalsize) to zip->entryuncompressedsize triggers a signed integer overflow, leading to undefined behavior per the C standard. This could result in incorrect Zip64 extension decisions or potential memory corruption.

The vulnerability is in the write path only and requires both ZIP encryption to be enabled and a file size near INT64MAX, making real-world exploitation unlikely.

Upstream issue: https://github.com/libarchive/libarchive/issues/3225 Upstream fix: https://github.com/libarchive/libarchive/pull/3228

A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archiveaclfromtextnl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).

A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archiveaclfromtextnl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).

archivereadsupportformatrar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

In Libarchive 3.4.0, archivewstringappendfrommbs in archivestring.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive.

An error in the lhareadfileheader1() function (archivereadsupportformatlha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.

Accessibility. A logging issue was addressed with improved data redaction.

Bookkeeping errors when extending the read-ahead buffer when trying to identify an mtree archive could lead libarchive to significantly overcalculate the size of the line being read, resulting in heap out-of-bounds reads or a crash.

Disclosed on oss-security:

http://seclists.org/oss-sec/2016/q3/516

Upstream issue:

https://github.com/libarchive/libarchive/issues/747

Upstream fix:

https://github.com/libarchive/libarchive/commit/eec077f

All the mtree-related crashes in the oss-sec post came from the same underlying issue and were resolved in this commit.

libarchive. A buffer overflow issue was addressed through improved memory handling.

A crafted 7zip archive with multiple headers of the same kind could cause calculated values from one being used to interpret the other, leading to out-of-bounds reads of adjacent structures on the heap.

Disclosed on oss-security:

http://seclists.org/oss-sec/2016/q3/516

Upstream issue:

https://github.com/libarchive/libarchive/issues/761

Upstream fix:

https://github.com/libarchive/libarchive/commit/7f17c79

A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (pzlog2bs) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

An Undefined Behavior vulnerability exists in the zisofs decompression logic of the libarchive library. The flaw is caused by improper validation of the pzlog2bs field, which is directly read from ISO9660 Rock Ridge extensions and used as a shift exponent in arithmetic operations. When a specially crafted ISO file provides an out-of-range value (e.g., ≥64 on 64-bit systems), it triggers undefined behavior due to invalid shift operations, leading to incorrect memory allocation and potential crashes. This vulnerability can be exploited by supplying a malicious ISO file, resulting in denial-of-service conditions in applications that process ISO images.

An issue was discovered in libarchive bsdtar before version 3.8.1 in function applysubstitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).

CVE-2016-10350 The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. CVE-2016-10349 The archivele32dec function in archiveendian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.

CVE-2016-10350 The archivereadformatcabreadheader function in archivereadsupportformatcab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. CVE-2016-10349 The archivele32dec function in archiveendian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.