{"id":"CVE-2024-48615","aliases":["AZL-59338","AZL-59377","AZL-59385","BELL-CVE-2024-48615","EUVD-2024-54322","GHSA-57fm-4q7w-88cr","JLSEC-2025-244","UBUNTU-CVE-2024-48615"],"status":"published","title":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program...","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00543,"percentile":0.45898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2025-03-28T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"cmake","fixed_in":["3.21.4-17"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libarchive","fixed_in":["3.6.1-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cmake","fixed_in":["3.30.3-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libarchive","fixed_in":["3.7.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libarchive","fixed_in":["3.7.7-r0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibArchive_jll","fixed_in":["3.7.9+0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.21.4-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.3-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.5-r0"},{"fixed":"3.7.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.5-r0"},{"fixed":"3.7.7-r0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibArchive_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.9+0"}]}]}],"products":[{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://github.com/libarchive/libarchive/releases/download/v3.7.6/libarchive-3.7.6.tar.gz","tags":["Product","web","report"]},{"url":"https://github.com/88Sanghy88/crash-test","tags":["exploit","Exploit","Third Party Advisory","package","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48615","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-57fm-4q7w-88cr"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-48615","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48615.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-48615","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48615","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-48615","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2025-04-01T13:42:43.591Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2024-54322","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2025-04-01T13:42:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:45.844316Z"}],"ghsa":[{"id":"GHSA-57fm-4q7w-88cr","title":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program...","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T15:31:56Z","modified":"2025-04-01T15:32:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:00:35.09643Z"}],"nvd":[{"id":"CVE-2024-48615","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T15:15:45.023Z","modified":"2026-06-17T07:58:37.273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"BELL-CVE-2024-48615","status":"published","published":"2025-04-01T05:57:57.430691Z","modified":"2026-01-26T09:35:19.720664Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.711507Z"},{"id":"CVE-2024-48615","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2026-10-28T02:30:27.527302331Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"JLSEC-2025-244","title":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar...","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function `header_pax_extension` at `rchive_read_support_format_tar.c:1844:8`.","status":"published","published":"2025-11-25T22:03:17.636Z","modified":"2026-07-23T22:30:23.980769421Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2024-48615","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"withdrawn","published":"2025-03-28T15:15:00Z","modified":"2025-07-16T08:17:29.538199Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"AZL-59338","title":"CVE-2024-48615 affecting package cmake for versions less than 3.21.4-17","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T15:15:45Z","modified":"2026-04-21T04:37:16.027063Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-59377","title":"CVE-2024-48615 affecting package libarchive for versions less than 3.6.1-6","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T15:15:45Z","modified":"2026-04-21T04:37:16.375096Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-59385","title":"CVE-2024-48615 affecting package cmake for versions less than 3.30.3-6","description":"Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.","status":"published","published":"2025-03-28T15:15:45Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.344052Z"}]}}