SUSE-SU-2026:3429-1
Security update for libarchive
No scoreFix available
SUSE-SU-2026:3429-1 is a vulnerability with no CVSS score yet in libarchive, published July 30, 2026. No source lists public exploit code. Fixed in libarchive 3.7.2-150600.3.23.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.7.2-150600.3.23.1libarchive +1 more
Description
This update for libarchive fixes the following issues:
- creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable (bsc#1254340).
- file descriptor leak in the mtree parser cleanup path could lead to file descriptor exhaustion and denial of service (bsc#1261003).
- NULL pointer dereference in archive_acl_from_text_w() could lead to a segmentation fault (bsc#1260998).
- reading from an invalid index when buffer size is smaller than H_LEVEL_OFFSET can lead to an out-of-bounds buffer overrun (bsc#1254341).
- incorrect pointer handling for RAR5 files declaring over 8192 filters can lead to excessive resource usage and denial of service (bsc#1261002).
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libarchiveSUSE:Linux Enterprise Module for Basesystem 15 SP7 | before 3.7.2-150600.3.23.1 | 3.7.2-150600.3.23.1 |
libarchiveSUSE:Linux Enterprise Module for Development Tools 15 SP7 | before 3.7.2-150600.3.23.1 | 3.7.2-150600.3.23.1 |
What each source reports
OSVNo score
Security update for libarchive
This update for libarchive fixes the following issues:
- creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable (bsc#1254340).
- file descriptor leak in the mtree parser cleanup path could lead to file descriptor exhaustion and denial of service (bsc#1261003).
- NULL pointer dereference in archive_acl_from_text_w() could lead to a segmentation fault (bsc#1260998).
- reading from an invalid index when buffer size is smaller than H_LEVEL_OFFSET can lead to an out-of-bounds buffer overrun (bsc#1254341).
- incorrect pointer handling for RAR5 files declaring over 8192 filters can lead to excessive resource usage and denial of service (bsc#1261002).
- Record
SUSE-SU-2026:3429-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.