CVE-2021-31566

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

Incorrect link resolution flaws can occur when extracting archives, resulting in changes to the mode, time, access control list, and flags of files outside the archive. An attacker could deliver malicious archives to victim users, triggering this vulnerability when they attempt to extract the archives. A local attacker could exploit this vulnerability to gain additional privileges on the system.(CVE-2021-31566)

Incorrect link resolution flaws when using ACLs to extract symbolic links can lead to changes to the access control list (ACL) of the link target. An attacker could deliver malicious archives to victim users, triggering this vulnerability when they attempt to extract the archives. A local attacker could exploit this vulnerability to change the ACL of a file on the system and gain more permissions.(CVE-2021-23177)

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: extracting a symlink with ACLs modifies ACLs of target (CVE-2021-23177)

• libarchive: symbolic links incorrectly followed when changing modes, times, ACL and flags of a file while extracting an archive (CVE-2021-31566)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: extracting a symlink with ACLs modifies ACLs of target (CVE-2021-23177)

• libarchive: symbolic links incorrectly followed when changing modes, times, ACL and flags of a file while extracting an archive (CVE-2021-31566)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2021-31566: extend backport with upstream 8a1bd5c and ede459d2 to close the trailing-slash variant of the fixup-list symlink-follow attack

• CVE-2021-31566: extend backport with upstream 8a1bd5c and ede459d2 to close the trailing-slash variant of the fixup-list symlink-follow attack

• SECURITY UPDATE: ACLs applied to a symbolic link modified the link target instead
  • debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic link modified the link target instead
  • CVE-2021-23177
• SECURITY UPDATE: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • debian/patches/CVE-2021-31566.patch: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • CVE-2021-31566
• SECURITY UPDATE: NULL pointer dereference when calloc() fails while allocating a write filter
  • debian/patches/CVE-2022-36227.patch: NULL pointer dereference when calloc() fails while allocating a write filter
  • CVE-2022-36227
• SECURITY UPDATE: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • CVE-2024-20696
• SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • debian/patches/CVE-2026-4424.patch: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • CVE-2026-4424
• SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • CVE-2026-5121
• SECURITY UPDATE: double free in the RAR4 reader with over 4 billion nodes
  • debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader with over 4 billion nodes
  • CVE-2025-5914
• SECURITY UPDATE: unchecked strftime() return and localtime() NULL dereference in the bsdtar verbose listing
  • debian/patches/CVE-2025-25724.patch: check the strftime() result so a custom locale whose expansion exceeds the 100-byte buffer cannot leave stale content in it, and guard localtime() returning NULL; backports upstream c9bc934e and ecce4674
  • CVE-2025-25724
• Guard the RAR seek cursor before the previous-block lookup
  • debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in archive_read_format_rar_seek_data() before reading dbo[cursor - 1], which would otherwise underflow; backports upstream e548c994
• Check the ISO9660 ZF entry length before reading its data bytes
  • debian/patches/iso9660-zf-length-check.patch: test data_length before data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry cannot be read past the SUSP region bound; backports upstream a9a73c0e

• CVE-2021-23177: fix extraction of ACLs to the symlink target instead of the link
• CVE-2021-31566: do not follow symlinks when fixing up permissions and file flags
• CVE-2026-5121: validate pz_log2_bs in the iso9660 zisofs reader

Processing fixup entries may follow symbolic links. (CVE-2021-31566)

libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). (CVE-2021-36976)

These are all security issues fixed in the bsdtar-3.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libarchive fixes the following issues:

• CVE-2021-31566: Fixed incorrect usage of file flags (bsc#1192426).
• Fixed issues where postprocessing alters symlink targets instead of actual file (bsc#1192427).

This update for libarchive fixes the following issues:

• CVE-2021-31566: Fixed vulnerability where libarchive modifies file flags of symlink target (bsc#1192426)
• Fixed issue where processing fixup entries may follow symbolic links (bsc#1192427).

It was discovered that libarchive incorrectly handled symlinks. If a user or automated system were tricked into processing a specially crafted archive, an attacker could possibly use this issue to change modes, times, ACLs, and flags on arbitrary files. (CVE-2021-23177, CVE-2021-31566)

It was discovered that libarchive incorrectly handled certain RAR archives. If a user or automated system were tricked into processing a specially crafted RAR archive, an attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36976)