{"id":"CVE-2024-20696","aliases":["ALPINE-CVE-2024-20696","CLSA-2026-1775647149","CLSA-2026-1775689506","CLSA-2026-1787908647","DEBIAN-CVE-2024-20696","DLA-3950-1","DSA-5806-1","EUVD-2024-18411","GHSA-g5xc-jv8h-2232","MGASA-2024-0363","OESA-2024-1715","SUSE-SU-2024:2081-1","SUSE-SU-2024:2082-1","SUSE-SU-2024:2083-1","SUSE-SU-2024:2171-1","SUSE-SU-2024:2171-2","SUSE-SU-2025:20050-1","SUSE-SU-2025:20257-1","UBUNTU-CVE-2024-20696","USN-7087-1","openSUSE-SU-2024:14378-1"],"status":"published","title":"Windows libarchive Remote Code Execution Vulnerability","description":"Windows libarchive Remote Code Execution Vulnerability","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03154,"percentile":0.88062,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-122"],"published":"2024-01-09T17:56:52Z","modified":"2026-11-02T12:00:57Z","exploits":[{"source":"pocgithub","id":"clearbluejar/CVE-2024-20696","title":"clearbluejar/CVE-2024-20696","date":"2024-03-08","url":"https://github.com/clearbluejar/CVE-2024-20696"}],"fixes":[{"ecosystem":"Alpine:v3.17","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","fixed_in":["3.5.3-6.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","fixed_in":["3.5.3-6.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","fixed_in":["3.5.3-6.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","fixed_in":["3.5.3-6.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","fixed_in":["3.5.3-6.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcat","fixed_in":["3.5.3-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcpio","fixed_in":["3.5.3-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdtar","fixed_in":["3.5.3-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive","fixed_in":["3.5.3-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive-devel","fixed_in":["3.5.3-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.6.2-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.7.4-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.7.4-1.1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libarchive","fixed_in":["3.6.2-5.3.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","fixed_in":["3.4.3-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"libarchive","fixed_in":["3.5.2-7.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libarchive","fixed_in":["3.5.2-7.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libarchive","fixed_in":["3.7.1-3.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libarchive","fixed_in":["3.3.3-32.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libarchive","fixed_in":["3.3.3-32.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libarchive","fixed_in":["3.3.3-32.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libarchive","fixed_in":["3.4.2-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libarchive","fixed_in":["3.4.2-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libarchive","fixed_in":["3.4.2-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libarchive","fixed_in":["3.4.2-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libarchive","fixed_in":["3.4.2-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libarchive","fixed_in":["3.4.2-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"libarchive","fixed_in":["3.4.2-150200.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"libarchive","fixed_in":["3.5.1-150400.3.15.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","fixed_in":["3.1.2-7ubuntu2.8+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","fixed_in":["3.1.2-11ubuntu0.16.04.8+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.7+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","fixed_in":["3.4.0-2ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.6.0-1ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","fixed_in":["3.7.2-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libarchive","fixed_in":["3.7.6-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1+deb12u2"}]}],"versions":["3.6.2-1","3.6.2-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-1.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-2+deb11u2"}]}],"versions":["3.4.3-2","3.4.3-2+deb11u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1+deb12u2"}]}],"versions":["3.6.2-1","3.6.2-1+deb12u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-5.3.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-7.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-7.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-3.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2-150200.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-slfo.1.1_2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm4"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1","3.1.2-7ubuntu2.8+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm2"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8","3.1.2-11ubuntu0.16.04.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm2"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7","3.2.2-3.1ubuntu0.7+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.4"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.3"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.3"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.4"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.3"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.3"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.6-1.1"}]}]}],"products":[{"vendor":"microsoft","product":"windows 10 version 1809"},{"vendor":"microsoft","product":"windows 10 version 21h2"},{"vendor":"microsoft","product":"windows 10 version 22h2"},{"vendor":"microsoft","product":"windows 11 version 21h2"},{"vendor":"microsoft","product":"windows 11 version 22h2"},{"vendor":"microsoft","product":"windows 11 version 22h3"},{"vendor":"microsoft","product":"windows 11 version 23h2"},{"vendor":"microsoft","product":"windows server 2019"},{"vendor":"microsoft","product":"windows server 2019 (server core installation)"},{"vendor":"microsoft","product":"windows server 2022"},{"vendor":"microsoft","product":"windows server 2022, 23h2 edition (server core installation)"},{"vendor":"microsoft","product":"windows_10_1809"},{"vendor":"microsoft","product":"windows_10_21h2"},{"vendor":"microsoft","product":"windows_10_22h2"},{"vendor":"microsoft","product":"windows_11_21h2"},{"vendor":"microsoft","product":"windows_11_22h2"},{"vendor":"microsoft","product":"windows_11_23h2"},{"vendor":"microsoft","product":"windows_server_2019"},{"vendor":"microsoft","product":"windows_server_2022"},{"vendor":"microsoft","product":"windows_server_2022_23h2"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20696","tags":["vendor-advisory","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://clearbluejar.github.io/posts/patch-tuesday-diffing-cve-2024-20696-windows-libarchive-rce/","tags":["x_transferred","web"]},{"url":"https://github.com/clearbluejar/CVE-2024-20696","tags":["x_transferred","package"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20696","tags":["advisory"]},{"url":"https://clearbluejar.github.io/posts/patch-tuesday-diffing-cve-2024-20696-windows-libarchive-rce"},{"url":"https://github.com/advisories/GHSA-g5xc-jv8h-2232"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-20696","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1775647149.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775689506.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787908647.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5121","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-20696","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0363.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33757","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00220.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1715","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242081-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225971","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20696","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242082-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242083-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225972","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20697","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242171-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242171-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520050-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231544","tags":["report"]},{"url":"https://bugzilla.suse.com/1231624","tags":["report"]},{"url":"https://bugzilla.suse.com/1237606","tags":["report"]},{"url":"https://bugzilla.suse.com/1238610","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25724","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-20696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-20696","tags":["report"]},{"url":"https://github.com/libarchive/libarchive/pull/2172","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7087-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8147-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YCGP76JWUXZIFMZWPNZW6VGRR63DPRBV/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-20696","title":"Windows libarchive Remote Code Execution Vulnerability","description":"Windows libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T17:56:52.848Z","modified":"2025-11-03T21:52:33.503Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:33:56.868512Z"}],"euvd":[{"id":"EUVD-2024-18411","description":"Windows libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T17:56:52Z","modified":"2025-11-03T21:52:33Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-g5xc-jv8h-2232","title":"Windows Libarchive Remote Code Execution Vulnerability","description":"Windows Libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T18:30:29Z","modified":"2025-11-04T00:31:47Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:04:29.580531Z"}],"nvd":[{"id":"CVE-2024-20696","description":"Windows libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T18:15:52.927Z","modified":"2026-06-17T07:07:39.72Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:09:30.070039Z"}],"osv":[{"id":"ALPINE-CVE-2024-20696","description":"Windows libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T18:15:52.927Z","modified":"2026-11-02T11:17:50.067954568Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2024-20696","description":"Windows libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T18:15:52.927Z","modified":"2026-04-16T04:32:16.231141598Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-20696","description":"Windows libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T18:15:52.927Z","modified":"2026-11-02T12:00:57.772528219Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"OESA-2024-1715","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\r\n\r\nWindows Libarchive Remote Code Execution Vulnerability(CVE-2024-20696)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:24.3467065Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2024-20696","description":"Windows libarchive Remote Code Execution Vulnerability","status":"published","published":"2024-01-09T18:15:00Z","modified":"2026-04-22T14:38:29.839598Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"CLSA-2026-1775647149","title":"libarchive: Fix of CVE-2024-20696","description":"- CVE-2024-20696: fix heap buffer overflow via negative copy length in RAR4 reader","status":"published","published":"2026-04-08T21:12:29Z","modified":"2026-06-01T00:32:21.367663927Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775689506","title":"libarchive: Fix of CVE-2024-20696","description":"- CVE-2024-20696: fix heap buffer overflow via negative copy length in RAR4 reader","status":"published","published":"2026-04-08T23:05:10Z","modified":"2026-06-01T00:32:46.673536381Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1787908647","title":"Fix of 8 CVEs","description":"   * SECURITY UPDATE: ACLs applied to a symbolic link modified the link\n     target instead\n     - debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic\n       link modified the link target instead\n     - CVE-2021-23177\n   * SECURITY UPDATE: symbolic links followed when changing modes, times,\n     ACLs and flags while extracting an archive\n     - debian/patches/CVE-2021-31566.patch: symbolic links followed when\n       changing modes, times, ACLs and flags while extracting an archive\n     - CVE-2021-31566\n   * SECURITY UPDATE: NULL pointer dereference when calloc() fails while\n     allocating a write filter\n     - debian/patches/CVE-2022-36227.patch: NULL pointer dereference when\n       calloc() fails while allocating a write filter\n     - CVE-2022-36227\n   * SECURITY UPDATE: integer overflow in the RAR4 reader allowing an\n     oversized memcpy in copy_from_lzss_window()\n     - debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4\n       reader allowing an oversized memcpy in copy_from_lzss_window()\n     - CVE-2024-20696\n   * SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the\n     RAR4 reader allowing an out-of-bounds read\n     - debian/patches/CVE-2026-4424.patch: LZSS window size mismatch\n       after a PPMd block in the RAR4 reader allowing an out-of-bounds\n       read\n     - CVE-2026-4424\n   * SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660\n     Rock Ridge ZF parser\n     - debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size\n       exponent in the ISO9660 Rock Ridge ZF parser\n     - CVE-2026-5121\n   * SECURITY UPDATE: double free in the RAR4 reader with over 4 billion\n     nodes\n     - debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader\n       with over 4 billion nodes\n     - CVE-2025-5914\n   * SECURITY UPDATE: unchecked strftime() return and localtime() NULL\n     dereference in the bsdtar verbose listing\n     - debian/patches/CVE-2025-25724.patch: check the strftime() result so a\n       custom locale whose expansion exceeds the 100-byte buffer cannot leave\n       stale content in it, and guard localtime() returning NULL; backports\n       upstream c9bc934e and ecce4674\n     - CVE-2025-25724\n   * Guard the RAR seek cursor before the previous-block lookup\n     - debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in\n       archive_read_format_rar_seek_data() before reading dbo[cursor - 1],\n       which would otherwise underflow; backports upstream e548c994\n   * Check the ISO9660 ZF entry length before reading its data bytes\n     - debian/patches/iso9660-zf-length-check.patch: test data_length before\n       data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry\n       cannot be read past the SUSP region bound; backports upstream a9a73c0e","status":"published","published":"2026-08-28T09:17:42Z","modified":"2026-10-26T09:43:54.435048564Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"DLA-3950-1","title":"libarchive - security update","status":"published","published":"2024-11-11T00:00:00Z","modified":"2026-03-09T01:20:53.195954Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5806-1","title":"libarchive - security update","status":"published","published":"2024-11-09T00:00:00Z","modified":"2026-03-09T02:09:01.384562Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0363","title":"Updated libarchive packages fix security vulnerability","description":"A heap-based out-of-bounds write vulnerability was discovered in\nlibarchive, a multi-format archive and compression library, which may\nresult in the execution of arbitrary code if a specially crafted RAR\narchive is processed. (CVE-2024-20696)\n","status":"published","published":"2024-11-13T18:48:01Z","modified":"2026-04-16T04:42:22.669267Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14378-1","title":"bsdtar-3.7.6-1.1 on GA media","description":"These are all security issues fixed in the bsdtar-3.7.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-02T00:00:00Z","modified":"2026-02-04T03:29:59.896193Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:2081-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).\n","status":"published","published":"2024-06-19T05:04:14Z","modified":"2026-02-04T04:05:23.297678Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2082-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).\n","status":"published","published":"2024-06-19T05:33:57Z","modified":"2026-02-04T02:16:33.714675Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2083-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (bsc#1225972).\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).\n","status":"published","published":"2024-06-19T06:33:39Z","modified":"2026-02-04T02:34:48.144142Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2171-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).\n","status":"published","published":"2024-06-22T21:34:34Z","modified":"2025-05-02T04:36:21.237226Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2171-2","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971).\n","status":"published","published":"2024-06-22T21:34:57Z","modified":"2026-02-04T04:23:51.852013Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:20050-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-20696: Fixed out-of-bounds access in in copy_from_lzss_window_to_unp() (bsc#1225971)\n- CVE-2024-20697: Fixed heap based buffer overflow in rar e8 filter (bsc#1225972)\n","status":"published","published":"2025-02-03T08:55:48Z","modified":"2026-03-23T04:48:08.768545Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20257-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)\n- CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)\n- CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)\n- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability  (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)\n- CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)\n\n","status":"published","published":"2025-03-31T14:21:24Z","modified":"2026-03-23T04:47:11.444555Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7087-1","title":"libarchive vulnerability","description":"It was discovered that libarchive incorrectly handled certain RAR archive\nfiles. If a user or automated system were tricked into processing a\nspecially crafted RAR archive, an attacker could use this issue to cause\nlibarchive to crash, resulting in a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2024-10-31T08:55:44Z","modified":"2026-04-22T10:53:58.320669Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}