{"id":"CVE-2022-36227","aliases":["ALPINE-CVE-2022-36227","ALSA-2023:2532","ALSA-2023:3018","AZL-11470","BELL-CVE-2022-36227","CLSA-2026-1787908647","DEBIAN-CVE-2022-36227","DLA-3294-1","DLA-3950-1","EUVD-2022-38946","GHSA-gpgf-w78r-4pvj","JLSEC-2025-237","MGASA-2022-0453","OESA-2022-2123","OESA-2022-2124","OESA-2022-2126","RHSA-2023:2532","RHSA-2023:3018","RHSA-2024:0146","RLSA-2023:3018","SUSE-SU-2022:4202-1","SUSE-SU-2022:4209-1","SUSE-SU-2022:4296-1","UBUNTU-CVE-2022-36227","USN-7070-1","openSUSE-SU-2024:12588-1"],"status":"published","title":"In libarchive 3.6.1, the software does not check for an error after calling calloc function that...","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02457,"percentile":0.84559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-11-22T00:00:00Z","modified":"2026-11-03T08:00:49Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"libarchive","fixed_in":["3.5.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libarchive","fixed_in":["3.6.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libarchive","fixed_in":["3.6.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.6.1-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"bsdtar","fixed_in":["3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive","fixed_in":["3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive-devel","fixed_in":["3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"bsdtar","fixed_in":["3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libarchive","fixed_in":["3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libarchive-devel","fixed_in":["3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libarchive","fixed_in":["3.6.1-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"libarchive","fixed_in":["3.3.3-4+deb10u3"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibArchive_jll","fixed_in":["3.7.4+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libarchive","fixed_in":["3.6.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"libarchive","fixed_in":["3.4.3-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"libarchive","fixed_in":["3.5.2-5.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libarchive","fixed_in":["3.4.3-6.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libarchive-debugsource","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libarchive-devel","fixed_in":["0:3.5.3-4.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debugsource","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcat-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcpio-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdtar-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debuginfo","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debugsource","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-devel","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdtar","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libarchive","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libarchive-debugsource","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"bsdcat-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"bsdcpio-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"bsdtar-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"libarchive-debuginfo","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"libarchive-debugsource","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"libarchive-devel","fixed_in":["0:3.3.3-4.el8_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libarchive","fixed_in":["0:3.3.3-5.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libarchive","fixed_in":["3.4.2-150200.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"libarchive","fixed_in":["3.4.2-150200.4.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libarchive","fixed_in":["3.4.2-150200.4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","fixed_in":["3.5.1-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libarchive","fixed_in":["3.5.1-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"libarchive","fixed_in":["3.5.1-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"libarchive","fixed_in":["3.5.1-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libarchive","fixed_in":["3.5.1-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libarchive","fixed_in":["3.3.3-32.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libarchive","fixed_in":["3.3.3-32.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libarchive","fixed_in":["3.3.3-32.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","fixed_in":["3.1.2-7ubuntu2.8+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","fixed_in":["3.1.2-11ubuntu0.16.04.8+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","fixed_in":["3.4.0-2ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.6.0-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bsdtar","fixed_in":["3.6.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-4+deb10u3"}]}],"versions":["3.3.3-4","3.3.3-4+deb10u1","3.3.3-4+deb10u2"]},{"source":"osv","ecosystem":"Debian:11","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-2+deb11u2"}]}],"versions":["3.4.3-2","3.4.3-2+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Julia","package":"LibArchive_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-5.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-6.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-4.el8_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm3"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm1"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm1"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.3"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.2"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm3"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm1"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm1"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.3"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.2"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.2"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libarchive","product":"libarchive"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://github.com/libarchive/libarchive/issues/1754","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://bugs.gentoo.org/882521","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00034.html","tags":["mailing-list","x_transferred","Third Party Advisory","article","web"]},{"url":"https://security.gentoo.org/glsa/202309-14","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36227","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS"},{"url":"https://github.com/advisories/GHSA-gpgf-w78r-4pvj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-36227","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:2532","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-36227","tags":["report"]},{"url":"https://bugzilla.redhat.com/2144972","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2532.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3018","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-3018.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-36227","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787908647.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5121","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36227.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-36227","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0453.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31179","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-November/013094.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N4XUJQ5ZT6HWNXMENJI7BA5SJHZCQSOO/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2123","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2124","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2126","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2144972","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2532.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36227","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3018.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0146","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0146.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:3018","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224202-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205629","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36227","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224209-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224296-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-36227","tags":["report"]},{"url":"https://github.com/libarchive/libarchive/pull/1759","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7070-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-48957","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48958","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-36227","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-10-08T21:03:23.04Z","updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-38946","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-10-08T21:03:23Z","updated_at":"2026-11-02T17:27:27.240961Z"}],"ghsa":[{"id":"GHSA-gpgf-w78r-4pvj","title":"In libarchive 3.6.1, the software does not check for an error after calling calloc function that...","description":"In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference or, in some cases, even arbitrary code execution.","status":"published","published":"2022-11-22T03:30:56Z","modified":"2025-11-04T00:30:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:04:25.970519Z"}],"nvd":[{"id":"CVE-2022-36227","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T02:15:11.003Z","modified":"2026-10-08T21:17:48.93Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:32.395456Z"}],"osv":[{"id":"ALPINE-CVE-2022-36227","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T02:15:11.003Z","modified":"2026-11-03T07:18:33.491020126Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-11470","title":"CVE-2022-36227 affecting package libarchive for versions less than 3.6.1-2","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T02:15:11Z","modified":"2026-04-21T04:22:08.199069Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"BELL-CVE-2022-36227","title":"CVE-2022-36227 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:05.19047Z","modified":"2026-01-26T09:45:38.455426Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"DEBIAN-CVE-2022-36227","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T02:15:11.003Z","modified":"2026-11-03T08:00:49.753762464Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"JLSEC-2025-237","title":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function...","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2025-11-25T22:03:17.636Z","modified":"2026-07-23T22:30:22.768406706Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2022-2123","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\r\n\r\nIn libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \u0026quot;In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\u0026quot;(CVE-2022-36227)","status":"published","published":"2022-12-02T11:05:26Z","modified":"2026-08-18T01:16:56.059067012Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2022-2124","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\r\n\r\nIn libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \u0026quot;In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\u0026quot;(CVE-2022-36227)","status":"published","published":"2022-12-02T11:05:26Z","modified":"2026-08-18T01:17:26.935514913Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2022-2126","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\r\n\r\nIn libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \u0026quot;In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\u0026quot;(CVE-2022-36227)","status":"published","published":"2022-12-02T11:05:26Z","modified":"2026-08-18T01:17:26.928341332Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:2532","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2024-09-16T09:55:29Z","modified":"2026-06-26T12:22:11.042358163Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:3018","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2024-09-16T09:55:39Z","modified":"2026-06-26T12:22:11.178052537Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2024:0146","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2024-09-16T09:55:49Z","modified":"2026-06-26T12:21:19.183831683Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RLSA-2023:3018","title":"Low: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2026-03-20T00:02:50.766829Z","modified":"2026-03-20T00:30:05.195692Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-36227","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T02:15:00Z","modified":"2026-04-22T13:26:04.88681Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"ALSA-2023:2532","title":"Low: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:56.906008226Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:3018","title":"Low: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:06.608368975Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2026-1787908647","title":"Fix of 8 CVEs","description":"   * SECURITY UPDATE: ACLs applied to a symbolic link modified the link\n     target instead\n     - debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic\n       link modified the link target instead\n     - CVE-2021-23177\n   * SECURITY UPDATE: symbolic links followed when changing modes, times,\n     ACLs and flags while extracting an archive\n     - debian/patches/CVE-2021-31566.patch: symbolic links followed when\n       changing modes, times, ACLs and flags while extracting an archive\n     - CVE-2021-31566\n   * SECURITY UPDATE: NULL pointer dereference when calloc() fails while\n     allocating a write filter\n     - debian/patches/CVE-2022-36227.patch: NULL pointer dereference when\n       calloc() fails while allocating a write filter\n     - CVE-2022-36227\n   * SECURITY UPDATE: integer overflow in the RAR4 reader allowing an\n     oversized memcpy in copy_from_lzss_window()\n     - debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4\n       reader allowing an oversized memcpy in copy_from_lzss_window()\n     - CVE-2024-20696\n   * SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the\n     RAR4 reader allowing an out-of-bounds read\n     - debian/patches/CVE-2026-4424.patch: LZSS window size mismatch\n       after a PPMd block in the RAR4 reader allowing an out-of-bounds\n       read\n     - CVE-2026-4424\n   * SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660\n     Rock Ridge ZF parser\n     - debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size\n       exponent in the ISO9660 Rock Ridge ZF parser\n     - CVE-2026-5121\n   * SECURITY UPDATE: double free in the RAR4 reader with over 4 billion\n     nodes\n     - debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader\n       with over 4 billion nodes\n     - CVE-2025-5914\n   * SECURITY UPDATE: unchecked strftime() return and localtime() NULL\n     dereference in the bsdtar verbose listing\n     - debian/patches/CVE-2025-25724.patch: check the strftime() result so a\n       custom locale whose expansion exceeds the 100-byte buffer cannot leave\n       stale content in it, and guard localtime() returning NULL; backports\n       upstream c9bc934e and ecce4674\n     - CVE-2025-25724\n   * Guard the RAR seek cursor before the previous-block lookup\n     - debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in\n       archive_read_format_rar_seek_data() before reading dbo[cursor - 1],\n       which would otherwise underflow; backports upstream e548c994\n   * Check the ISO9660 ZF entry length before reading its data bytes\n     - debian/patches/iso9660-zf-length-check.patch: test data_length before\n       data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry\n       cannot be read past the SUSP region bound; backports upstream a9a73c0e","status":"published","published":"2026-08-28T09:17:42Z","modified":"2026-10-26T09:43:54.435048564Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CVE-2022-36227","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","status":"published","published":"2022-11-22T00:00:00Z","modified":"2026-10-28T02:30:36.629669181Z","updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"DLA-3294-1","title":"libarchive - security update","status":"published","published":"2023-01-30T00:00:00Z","modified":"2026-03-09T01:19:36.748951Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3950-1","title":"libarchive - security update","status":"published","published":"2024-11-11T00:00:00Z","modified":"2026-03-09T01:20:53.195954Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0453","title":"Updated libarchive packages fix security vulnerability","description":"In libarchive 3.6.1, the software does not check for an error after\ncalling calloc function that can return with a NULL pointer if the\nfunction fails, which leads to a resultant NULL pointer dereference.\n(CVE-2022-36227)\n","status":"published","published":"2022-12-13T22:09:19Z","modified":"2026-04-16T04:41:41.429934065Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12588-1","title":"bsdtar-3.6.2-1.1 on GA media","description":"These are all security issues fixed in the bsdtar-3.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:53.500061Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:4202-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2022-36227: Fixed potential NULL pointer dereference in __archive_write_allocate_filter() (bsc#1205629).\n","status":"published","published":"2022-11-23T14:34:58Z","modified":"2026-02-04T02:29:22.136004Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4209-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2022-36227: Fixed potential NULL pointer dereference in __archive_write_allocate_filter() (bsc#1205629).\n","status":"published","published":"2022-11-23T16:36:54Z","modified":"2026-02-04T02:32:04.036088Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4296-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2022-36227: Fixed potential NULL pointer dereference in __archive_write_allocate_filter() (bsc#1205629).\n","status":"published","published":"2022-11-29T15:02:47Z","modified":"2026-02-04T04:12:33.050935Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-7070-1","title":"libarchive vulnerabilities","description":"It was discovered that libarchive mishandled certain memory checks,\nwhich could result in a NULL pointer dereference. An attacker could\npotentially use this issue to cause a denial of service. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-36227)\n\nIt was discovered that libarchive mishandled certain memory operations,\nwhich could result in an out-of-bounds memory access. An attacker could\npotentially use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-48957, CVE-2024-48958)\n","status":"published","published":"2024-10-16T04:36:11Z","modified":"2026-06-29T13:51:18.046553479Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}