Every CVE Search/ Get API key

CVE-2024-57970

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in...

4.0 MediumFix available

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.25%Up 0.2 points since Feb 16, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Record
CVE-2024-57970
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-126
Updated
2026-11-02
EUVDEUVD-2024-53870 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Record
EUVD-2024-53870
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-2q66-6w43-8rm9 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in...

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Record
GHSA-2q66-6w43-8rm9
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-126
Updated
2026-11-02
NVD 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Record
CVE-2024-57970
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-126
Updated
2026-11-02
OSVALPINE-CVE-2024-57970 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Record
ALPINE-CVE-2024-57970
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBELL-CVE-2024-57970 4.0
Record
BELL-CVE-2024-57970
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 6 moreShow less
OSV 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Record
CVE-2024-57970
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-126
Updated
2026-11-02
OSVJLSEC-2025-250 4.0

libarchive through 3.7.7 has a heap-based buffer over-read in `header_gnu_longlink` in...

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

Record
JLSEC-2025-250
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:7510 4.0

Red Hat Security Advisory: libarchive security update

Record
RHSA-2025:7510
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2025:7510 4.0

Moderate: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

  • libarchive: heap buffer over-read in header_gnu_longlink (CVE-2024-57970)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:7510
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2025:7510 No score

Moderate: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

  • libarchive: heap buffer over-read in header_gnu_longlink (CVE-2024-57970)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:7510
Updated
2026-11-02
OSVopenSUSE-SU-2025:14844-1 No score

bsdtar-3.7.7-2.1 on GA media

These are all security issues fixed in the bsdtar-3.7.7-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14844-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libarchive
Alpine:v3.18
 before 3.7.9-r0
3.7.9-r0
libarchive
Alpine:v3.19
 before 3.7.9-r0
3.7.9-r0
libarchive
Alpine:v3.20
 before 3.7.9-r0
3.7.9-r0
libarchive
Alpine:v3.21
 before 3.7.9-r0
3.7.9-r0
libarchive
Alpine:v3.22
 before 3.7.9-r0
3.7.9-r0
libarchive
Alpine:v3.23
 before 3.7.9-r0
3.7.9-r0
libarchive
Alpine:v3.24
 before 3.7.9-r0
3.7.9-r0
bsdtar
AlmaLinux:10
 before 3.7.7-2.el10_0
3.7.7-2.el10_0
libarchive
AlmaLinux:10
 before 3.7.7-2.el10_0
3.7.7-2.el10_0
libarchive-devel
AlmaLinux:10
 before 3.7.7-2.el10_0
3.7.7-2.el10_0
Show 14 moreShow less
Affected packages
PackageAffectedFixed
libarchive
Alpaquita:23
 3.6.1-r1 up to 3.7.9-r0
3.7.9-r0
libarchive
Alpaquita:stream
 3.6.2-r1 up to 3.7.9-r0
3.7.9-r0
LibArchive_jll
Julia
 before 3.7.9+0
3.7.9+0
bsdcat-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
bsdcpio-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
bsdtar
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
bsdtar-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
bsdunzip-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
libarchive-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
libarchive-debugsource
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
libarchive-devel
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
libarchive
Red Hat:enterprise_linux:10.0
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
libarchive
Rocky Linux:10
 before 0:3.7.7-2.el10_0
0:3.7.7-2.el10_0
libarchive
openSUSE:Tumbleweed
 before 3.7.7-2.1
3.7.7-2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-57970 is a medium vulnerability (CVSS 4.0) in Libarchive, published February 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in libarchive 3.7.9-r0.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open