CVE-2025-25724

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-1632)

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-1632)

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)

is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .

Security Fix(es):

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es):

• libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

• CVE-2025-25724: fix buffer overflow vulnerability in libarchive

• CVE-2025-25724: fix crash in list_item_verbose on invalid time

• CVE-2025-25724: fix buffer overflow vulnerability in libarchive

• SECURITY UPDATE: ACLs applied to a symbolic link modified the link target instead
  • debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic link modified the link target instead
  • CVE-2021-23177
• SECURITY UPDATE: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • debian/patches/CVE-2021-31566.patch: symbolic links followed when changing modes, times, ACLs and flags while extracting an archive
  • CVE-2021-31566
• SECURITY UPDATE: NULL pointer dereference when calloc() fails while allocating a write filter
  • debian/patches/CVE-2022-36227.patch: NULL pointer dereference when calloc() fails while allocating a write filter
  • CVE-2022-36227
• SECURITY UPDATE: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4 reader allowing an oversized memcpy in copy_from_lzss_window()
  • CVE-2024-20696
• SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • debian/patches/CVE-2026-4424.patch: LZSS window size mismatch after a PPMd block in the RAR4 reader allowing an out-of-bounds read
  • CVE-2026-4424
• SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size exponent in the ISO9660 Rock Ridge ZF parser
  • CVE-2026-5121
• SECURITY UPDATE: double free in the RAR4 reader with over 4 billion nodes
  • debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader with over 4 billion nodes
  • CVE-2025-5914
• SECURITY UPDATE: unchecked strftime() return and localtime() NULL dereference in the bsdtar verbose listing
  • debian/patches/CVE-2025-25724.patch: check the strftime() result so a custom locale whose expansion exceeds the 100-byte buffer cannot leave stale content in it, and guard localtime() returning NULL; backports upstream c9bc934e and ecce4674
  • CVE-2025-25724
• Guard the RAR seek cursor before the previous-block lookup
  • debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in archive_read_format_rar_seek_data() before reading dbo[cursor - 1], which would otherwise underflow; backports upstream e548c994
• Check the ISO9660 ZF entry length before reading its data bytes
  • debian/patches/iso9660-zf-length-check.patch: test data_length before data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry cannot be read past the SUSP region bound; backports upstream a9a73c0e

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale. (CVE-2025-25724

These are all security issues fixed in the bsdtar-3.7.7-3.1 package on the GA media of openSUSE Tumbleweed.

This update for libarchive fixes the following issues:

• CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)
• CVE-2025-25724: Fixed buffer overflow vulnerability in function list_item_verbose() in tar/util.c (bsc#1238610)

This update for libarchive fixes the following issues:

• CVE-2025-25724: Fixed buffer overflow vulnerability in function list_item_verbose() in tar/util.c (bsc#1238610).

This update for libarchive fixes the following issues:

• CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)
• CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)
• CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)
• CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)
• CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)
• CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)

It was discovered that the libarchive bsdunzip utility incorrectly handled certain ZIP archive files. If a user or automated system were tricked into processing a specially crafted ZIP archive, an attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-1632)

It was discovered that libarchive incorrectly handled certain TAR archive files. If a user or automated system were tricked into processing a specially crafted TAR archive, an attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-25724)