CVE-2024-20696

Windows libarchive Remote Code Execution Vulnerability

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

Windows Libarchive Remote Code Execution Vulnerability(CVE-2024-20696)

Windows libarchive Remote Code Execution Vulnerability

• CVE-2024-20696: fix heap buffer overflow via negative copy length in RAR4 reader

• CVE-2024-20696: fix heap buffer overflow via negative copy length in RAR4 reader

• SECURITY UPDATE: ACLs applied to a symbolic link modified the link target instead
  • debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic link modified the link target instead
  • CVE-2021-23177
• SECURITY UPDATE: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • debian/patches/CVE-2021-31566.patch: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • CVE-2021-31566
• SECURITY UPDATE: NULL pointer dereference when calloc() fails while allocating a write filter
  • debian/patches/CVE-2022-36227.patch: NULL pointer dereference when calloc() fails while allocating a write filter
  • CVE-2022-36227
• SECURITY UPDATE: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • CVE-2024-20696
• SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • debian/patches/CVE-2026-4424.patch: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • CVE-2026-4424
• SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • CVE-2026-5121
• SECURITY UPDATE: double free in the RAR4 reader with over 4 billion nodes
  • debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader with over 4 billion nodes
  • CVE-2025-5914
• SECURITY UPDATE: unchecked strftime() return and localtime() NULL dereference in the bsdtar verbose listing
  • debian/patches/CVE-2025-25724.patch: check the strftime() result so a custom locale whose expansion exceeds the 100-byte buffer cannot leave stale content in it, and guard localtime() returning NULL; backports upstream c9bc934e and ecce4674
  • CVE-2025-25724
• Guard the RAR seek cursor before the previous-block lookup
  • debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in archive_read_format_rar_seek_data() before reading dbo[cursor - 1], which would otherwise underflow; backports upstream e548c994
• Check the ISO9660 ZF entry length before reading its data bytes
  • debian/patches/iso9660-zf-length-check.patch: test data_length before data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry cannot be read past the SUSP region bound; backports upstream a9a73c0e

A heap-based out-of-bounds write vulnerability was discovered in libarchive, a multi-format archive and compression library, which may result in the execution of arbitrary code if a specially crafted RAR archive is processed. (CVE-2024-20696)

These are all security issues fixed in the bsdtar-3.7.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libarchive fixes the following issues:

• CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).

This update for libarchive fixes the following issues:

• CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).

This update for libarchive fixes the following issues:

• CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (bsc#1225972).
• CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).

This update for libarchive fixes the following issues:

• CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).

This update for libarchive fixes the following issues:

• CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).

This update for libarchive fixes the following issues:

• CVE-2024-20696: Fixed out-of-bounds access in in copy_from_lzss_window_to_unp() (bsc#1225971)
• CVE-2024-20697: Fixed heap based buffer overflow in rar e8 filter (bsc#1225972)

This update for libarchive fixes the following issues:

• CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)
• CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)
• CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)
• CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)
• CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)
• CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)

It was discovered that libarchive incorrectly handled certain RAR archive files. If a user or automated system were tricked into processing a specially crafted RAR archive, an attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code.