{"id":"CVE-2017-11125","aliases":["DEBIAN-CVE-2017-11125","EUVD-2017-2762","GHSA-hp8r-5243-x9f3","openSUSE-SU-2026:11103-1","openSUSE-SU-2026:21153-1"],"status":"published","title":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","description":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01951,"percentile":0.80368,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2017-07-10T03:00:00Z","modified":"2026-10-24T10:30:51Z","fixes":[{"ecosystem":"Debian:13","package":"xar","fixed_in":["1.8.0.498-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xar","fixed_in":["1.8.0.498-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"xar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.498-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.498-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.0.503-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"xar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.0.503-bp160.1.1"}]}],"bundled":4}],"products":[{"vendor":"xar_project","product":"xar"}],"references":[{"url":"https://blogs.gentoo.org/ago/2017/06/28/xar-null-pointer-dereference-in-xar_get_path-util-c/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2S2KRIILUKBJHXDNYJQQX74TFUQRG5ND/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YV6RF6VWM7AFYFTTS7VY5TNH26QUEEFC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11125"},{"url":"https://blogs.gentoo.org/ago/2017/06/28/xar-null-pointer-dereference-in-xar_get_path-util-c"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2S2KRIILUKBJHXDNYJQQX74TFUQRG5ND"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YV6RF6VWM7AFYFTTS7VY5TNH26QUEEFC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S2KRIILUKBJHXDNYJQQX74TFUQRG5ND"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YV6RF6VWM7AFYFTTS7VY5TNH26QUEEFC"},{"url":"https://github.com/advisories/GHSA-hp8r-5243-x9f3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-11125","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17094","tags":["web"]},{"url":"https://bugzilla.suse.com/1047874","tags":["report"]},{"url":"https://bugzilla.suse.com/1047875","tags":["report"]},{"url":"https://bugzilla.suse.com/1108595","tags":["report"]},{"url":"https://bugzilla.suse.com/1108596","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-11125","description":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","status":"published","published":"2017-07-10T03:00:00Z","modified":"2024-08-05T17:57:57.865Z","updated_at":"2026-11-02T14:33:19.848632Z"}],"euvd":[{"id":"EUVD-2017-2762","description":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","status":"published","published":"2017-07-10T03:00:00Z","modified":"2024-08-05T17:57:57Z","updated_at":"2026-11-03T02:23:24.743229Z"}],"ghsa":[{"id":"GHSA-hp8r-5243-x9f3","title":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","description":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","status":"published","published":"2022-05-13T01:28:42Z","modified":"2025-04-20T03:40:30Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:01:48.455381Z"}],"nvd":[{"id":"CVE-2017-11125","description":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","status":"published","published":"2017-07-10T03:29:00.223Z","modified":"2026-06-17T01:01:15.917Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"CVE-2017-11125","description":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","status":"published","published":"2017-07-10T03:29:00.223Z","modified":"2026-10-24T10:30:51.472969614Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-11125","description":"libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.","status":"published","published":"2017-07-10T03:29:00.223Z","modified":"2026-09-01T20:03:40.944763425Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"openSUSE-SU-2026:11103-1","title":"libxar-devel-1.8.0.0.503-1.1 on GA media","description":"These are all security issues fixed in the libxar-devel-1.8.0.0.503-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:05.119519667Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21153-1","title":"Security update for xar","description":"This update for xar fixes the following issues:\n\nChanges in xar:\n\n- Switch to the maintained Apple xar lineage (build 503, versioned\n  1.8.0.0.503): the mackyle 1.6.1 fork this package tracked has been\n  dead since 2012, and Debian, Fedora and Gentoo all moved to Apple's\n  xar (apple-oss-distributions/xar). This resolves the long-standing\n  NULL-pointer dereferences in xar_get_path() and xar_unserialize()\n  when parsing malformed archives:\n  * CVE-2017-11124 (boo#1047875)\n  * CVE-2017-11125 (boo#1047874)\n  * CVE-2018-17093 (boo#1108595)\n  * CVE-2018-17094 (boo#1108596)\n","status":"published","published":"2026-06-23T13:02:10Z","modified":"2026-06-30T18:24:46.131507698Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}