{"id":"CVE-2021-36976","aliases":["ALPINE-CVE-2021-36976","AZL-6614","BELL-CVE-2021-36976","DEBIAN-CVE-2021-36976","DLA-3950-1","EUVD-2021-23552","GHSA-4fxq-mcvv-8fqm","JLSEC-2025-234","MGASA-2022-0060","OESA-2021-1398","RHBA-2022:3897","SUSE-SU-2022:0944-1","SUSE-SU-2022:0944-2","SUSE-SU-2022:1930-1","UBUNTU-CVE-2021-36976","USN-5291-1","openSUSE-SU-2022:0944-1","openSUSE-SU-2024:11894-1"],"status":"published","title":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from...","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02845,"percentile":0.86805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-07-20T06:49:15Z","modified":"2026-11-04T02:30:54Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"libarchive","fixed_in":["3.5.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libarchive","fixed_in":["3.5.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.6.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libarchive","fixed_in":["3.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.6.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibArchive_jll","fixed_in":["3.7.4+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libarchive","fixed_in":["3.4.3-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"libarchive","fixed_in":["3.4.3-3.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","fixed_in":["3.4.0-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.5.2-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.5.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.5.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1"},{"fixed":"3.6.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-2+deb11u2"}]}],"versions":["3.4.3-2","3.4.3-2+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Julia","package":"LibArchive_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-3.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.1"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1ubuntu1"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.1"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"macos"},{"vendor":"apple","product":"watchos"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libarchive","product":"libarchive"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libarchive/OSV-2021-557.yaml","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32375","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SE5NJQNM22ZE5Z55LPAGCUHSBQZBKMKC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213183","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213182","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213193","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Mar/28","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Mar/29","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Mar/27","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202208-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36976","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SE5NJQNM22ZE5Z55LPAGCUHSBQZBKMKC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SE5NJQNM22ZE5Z55LPAGCUHSBQZBKMKC"},{"url":"https://github.com/advisories/GHSA-4fxq-mcvv-8fqm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-36976","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-36976","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-36976","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0060.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30023","tags":["report"]},{"url":"https://github.com/libarchive/libarchive/releases/tag/v3.5.3","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1398","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2022:3897","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.0_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996634","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_3897.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984646","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36976","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1022528","tags":["report"]},{"url":"https://bugzilla.suse.com/1188572","tags":["report"]},{"url":"https://bugzilla.suse.com/1189528","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36976","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220944-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221930-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197634","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26280","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-36976","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5291-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-31566","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2GOSOUIKGPKMNRIKY4M2SLF54G6W2YC4/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31566","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-36976","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T06:49:15Z","modified":"2026-11-02T18:04:25.913Z","updated_at":"2026-11-02T19:47:06.831391Z"}],"euvd":[{"id":"EUVD-2021-23552","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T06:49:15Z","modified":"2026-11-02T18:04:25Z","updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-4fxq-mcvv-8fqm","title":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from...","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2022-05-24T19:08:29Z","modified":"2025-11-04T00:30:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:25.970519Z"}],"nvd":[{"id":"CVE-2021-36976","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T07:15:07.95Z","modified":"2026-11-02T19:17:43.83Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-03T00:01:40.46005Z"}],"osv":[{"id":"ALPINE-CVE-2021-36976","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T07:15:07.95Z","modified":"2026-10-23T17:17:56.2027248Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6614","title":"CVE-2021-36976 affecting package libarchive for versions less than 3.6.0-1","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T07:15:07Z","modified":"2026-04-21T04:37:47.481713Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"BELL-CVE-2021-36976","title":"CVE-2021-36976 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:55.646667Z","modified":"2026-01-26T09:45:38.944995Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-36976","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T07:15:07.95Z","modified":"2026-11-04T02:30:54.59480367Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"DEBIAN-CVE-2021-36976","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T07:15:07.95Z","modified":"2026-11-03T09:47:24.912715065Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"JLSEC-2025-234","title":"libarchive 3.4.1 through 3.5.1 has a use-after-free in `copy_string` (called from...","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in `copy_string` (called from `do_uncompress_block` and `process_block`).","status":"published","published":"2025-11-25T22:03:17.636Z","modified":"2026-07-23T22:30:12.453601097Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2021-1398","title":"libarchive security update","description":"libarchive is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use libarchive.\r\n\r\nSecurity Fix(es):\r\n\r\nlibarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).(CVE-2021-36976)","status":"published","published":"2021-10-19T11:04:40Z","modified":"2026-08-18T01:16:09.487093404Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHBA-2022:3897","title":"Red Hat Bug Fix Advisory: new packages: libarchive","status":"withdrawn","published":"2026-09-09T10:01:36Z","modified":"2026-09-12T14:00:04.713522061Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2021-36976","description":"libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).","status":"published","published":"2021-07-20T07:15:00Z","modified":"2026-04-22T12:57:16.362015Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"DLA-3950-1","title":"libarchive - security update","status":"published","published":"2024-11-11T00:00:00Z","modified":"2026-03-09T01:20:53.195954Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0060","title":"Updated libarchive packages fix security vulnerability","description":"Processing fixup entries may follow symbolic links. (CVE-2021-31566)\n\nlibarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called\nfrom do_uncompress_block and process_block). (CVE-2021-36976)\n","status":"published","published":"2022-02-12T17:31:35Z","modified":"2026-04-16T04:41:02.618303577Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0944-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2021-36976: Fixed an invalid memory access that could cause data\n  corruption (bsc#1188572).\n\nNon-security updates:\n\n- Updated references for CVE-2017-5601, which was already fixed in a previous\n  version (bsc#1022528 bsc#1189528).\n","status":"published","published":"2022-03-24T11:53:21Z","modified":"2026-02-04T03:19:44.10699Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11894-1","title":"bsdtar-3.6.0-1.1 on GA media","description":"These are all security issues fixed in the bsdtar-3.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:38:37.477192Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:0944-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2021-36976: Fixed an invalid memory access that could cause data\n  corruption (bsc#1188572).\n\nNon-security updates:\n\n- Updated references for CVE-2017-5601, which was already fixed in a previous\n  version (bsc#1022528 bsc#1189528).\n","status":"published","published":"2022-03-24T11:53:11Z","modified":"2026-02-04T02:46:59.140986Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0944-2","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2021-36976: Fixed an invalid memory access that could cause data\n  corruption (bsc#1188572).\n\nNon-security updates:\n\n- Updated references for CVE-2017-5601, which was already fixed in a previous\n  version (bsc#1022528 bsc#1189528).\n","status":"published","published":"2023-01-31T07:08:31Z","modified":"2026-02-04T02:52:12.356977Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:1930-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2022-26280: Fixed out-of-bounds read via the component zipx_lzma_alone_init (bsc#1197634).\n- CVE-2021-36976: Fixed use-after-free in copy_string (called from do_uncompress_block and process_block) (bsc#1188572).\n- CVE-2017-5601: Fixed out-of-bounds memory access preventing denial-of-service (bsc#1197634, bsc#1189528).\n","status":"published","published":"2022-06-02T15:34:49Z","modified":"2026-02-04T04:20:25.430978Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5291-1","title":"libarchive vulnerabilities","description":"It was discovered that libarchive incorrectly handled symlinks. If a\nuser or automated system were tricked into processing a specially crafted\narchive, an attacker could possibly use this issue to change modes, times,\nACLs, and flags on arbitrary files. (CVE-2021-23177, CVE-2021-31566)\n\nIt was discovered that libarchive incorrectly handled certain RAR archives.\nIf a user or automated system were tricked into processing a specially\ncrafted RAR archive, an attacker could use this issue to cause libarchive\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2021-36976)\n","status":"published","published":"2022-02-17T13:54:10Z","modified":"2026-04-22T10:21:26.157013Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}