{"id":"CVE-2024-48958","aliases":["ALPINE-CVE-2024-48958","AZL-50305","AZL-50310","BELL-CVE-2024-48958","DEBIAN-CVE-2024-48958","EUVD-2024-43151","GHSA-9mw4-2ppr-4mcg","JLSEC-2025-241","MGASA-2024-0346","OESA-2024-2286","SUSE-SU-2024:3940-1","SUSE-SU-2025:20087-1","SUSE-SU-2025:20257-1","UBUNTU-CVE-2024-48958","USN-7070-1"],"status":"published","title":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out...","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00552,"percentile":0.46396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-10-10T00:00:00Z","modified":"2026-11-02T12:03:03Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libarchive","fixed_in":["3.7.7-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libarchive","fixed_in":["3.6.1-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libarchive","fixed_in":["3.7.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.6.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.7.2-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.7.2-2.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibArchive_jll","fixed_in":["3.7.9+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.6.0-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","fixed_in":["3.7.2-2ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-r1"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.2-r1"},{"fixed":"3.7.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1+deb12u1"}]}],"versions":["3.6.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2.1"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibArchive_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.7.4+0"},{"fixed":"3.7.9+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-5.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-5.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-slfo.1.1_2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.2"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.2"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm3"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm1"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm1"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.3"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.2"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.2"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1"],"bundled":3}],"products":[{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://github.com/libarchive/libarchive/compare/v3.7.4...v3.7.5","tags":["Patch","web","report"]},{"url":"https://github.com/libarchive/libarchive/pull/2148","tags":["Patch","fix","web","report"]},{"url":"https://github.com/terrynini/CVE-Reports/tree/main/CVE-2024-48958","tags":["Exploit","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/13","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/8","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/4","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/12","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/11","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48958","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9mw4-2ppr-4mcg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-48958","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-48958","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48958.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-48958","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0346.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33717","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48957","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243940-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225972","tags":["report"]},{"url":"https://bugzilla.suse.com/1231624","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48958","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520087-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231544","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48957","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225971","tags":["report"]},{"url":"https://bugzilla.suse.com/1237606","tags":["report"]},{"url":"https://bugzilla.suse.com/1238610","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25724","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-48958","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-48958","tags":["report"]},{"url":"https://github.com/libarchive/libarchive/commit/a1cb648d52f5b6d3f31184d9b6a7cbca628459b7","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7070-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-36227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-48957","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-48958","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T00:00:00Z","modified":"2025-11-03T20:41:07.588Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:11.97482Z"}],"euvd":[{"id":"EUVD-2024-43151","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T00:00:00Z","modified":"2025-11-03T20:41:07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:32.126029Z"}],"ghsa":[{"id":"GHSA-9mw4-2ppr-4mcg","title":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out...","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T03:30:45Z","modified":"2025-11-03T21:31:16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2024-48958","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T02:15:03.057Z","modified":"2026-06-17T07:59:07.683Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:10:31.271525Z"}],"osv":[{"id":"ALPINE-CVE-2024-48958","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T02:15:03.057Z","modified":"2026-11-02T11:17:50.122700988Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-50305","title":"CVE-2024-48958 affecting package libarchive for versions less than 3.7.7-1","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T02:15:03Z","modified":"2026-04-21T04:54:04.179308Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-50310","title":"CVE-2024-48958 affecting package libarchive for versions less than 3.6.1-4","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T02:15:03Z","modified":"2026-04-21T04:30:10.731262Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"BELL-CVE-2024-48958","status":"published","published":"2024-10-11T05:57:02.909481Z","modified":"2026-01-26T09:35:19.987153Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.711507Z"},{"id":"CVE-2024-48958","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T00:00:00Z","modified":"2026-10-28T02:30:41.524009888Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-48958","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-10T02:15:03.057Z","modified":"2026-11-02T12:03:03.847474961Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.798789Z"},{"id":"JLSEC-2025-241","title":"`execute_filter_delta` in `archive_read_support_format_rar.c` in libarchive before 3.7.5 allows...","description":"`execute_filter_delta` in `archive_read_support_format_rar.c` in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2025-11-25T22:03:17.636Z","modified":"2026-07-23T22:30:22.973411696Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2024-2286","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\r\n\r\nexecute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.(CVE-2024-48957)\r\n\r\nexecute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.(CVE-2024-48958)","status":"published","published":"2024-10-18T11:07:45Z","modified":"2026-08-18T01:17:35.520357154Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-48958","description":"execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.","status":"published","published":"2024-10-11T00:00:00Z","modified":"2026-04-22T15:12:35.792933Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"MGASA-2024-0346","title":"Updated libarchive packages fix security vulnerabilities","description":"execute_filter_audio in archive_read_support_format_rar.c in libarchive\nbefore 3.7.5 allows out-of-bounds access via a crafted archive file\nbecause src can move beyond dst. (CVE-2024-48957)\nexecute_filter_delta in archive_read_support_format_rar.c in libarchive\nbefore 3.7.5 allows out-of-bounds access via a crafted archive file\nbecause src can move beyond dst. (CVE-2024-48958)\n","status":"published","published":"2024-11-06T19:57:10Z","modified":"2026-04-16T04:41:22.697790243Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:3940-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability (bsc#1225972).\n- CVE-2024-48958: Fixed out-of-bounds access via a crafted archive file in execute_filter_delta function (bsc#1231624).\n","status":"published","published":"2024-11-07T10:09:07Z","modified":"2026-02-04T04:08:28.449368Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:20087-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624).\n- CVE-2024-20697: Fixed out-of-bounds remote code execution vulnerability (bsc#1225972).\n- CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544).\n","status":"published","published":"2025-02-03T09:09:12Z","modified":"2026-03-23T04:48:52.342451Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20257-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)\n- CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)\n- CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)\n- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability  (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)\n- CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)\n\n","status":"published","published":"2025-03-31T14:21:24Z","modified":"2026-03-23T04:47:11.444555Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7070-1","title":"libarchive vulnerabilities","description":"It was discovered that libarchive mishandled certain memory checks,\nwhich could result in a NULL pointer dereference. An attacker could\npotentially use this issue to cause a denial of service. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-36227)\n\nIt was discovered that libarchive mishandled certain memory operations,\nwhich could result in an out-of-bounds memory access. An attacker could\npotentially use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-48957, CVE-2024-48958)\n","status":"published","published":"2024-10-16T04:36:11Z","modified":"2026-06-29T13:51:18.046553479Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}