{"id":"CVE-2024-57970","aliases":["ALPINE-CVE-2024-57970","ALSA-2025:7510","BELL-CVE-2024-57970","EUVD-2024-53870","GHSA-2q66-6w43-8rm9","JLSEC-2025-250","RHSA-2025:7510","RLSA-2025:7510","openSUSE-SU-2025:14844-1"],"status":"published","title":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in...","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0025,"percentile":0.16545,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-126"],"published":"2025-02-16T00:00:00Z","modified":"2026-11-02T11:17:50Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"bsdtar","fixed_in":["3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive","fixed_in":["3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive-devel","fixed_in":["3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibArchive_jll","fixed_in":["3.7.9+0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcat-debuginfo","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcpio-debuginfo","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar-debuginfo","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdunzip-debuginfo","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debuginfo","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debugsource","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-devel","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"libarchive","fixed_in":["0:3.7.7-2.el10_0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libarchive","fixed_in":["3.7.7-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-r1"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.2-r1"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibArchive_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.9+0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdunzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-2.el10_0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-2.1"}]}]}],"products":[{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://github.com/libarchive/libarchive/issues/2415","tags":["report","web","article"]},{"url":"https://github.com/libarchive/libarchive/pull/2422","tags":["fix","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57970","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-2q66-6w43-8rm9","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-57970","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7510","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-57970","tags":["report"]},{"url":"https://bugzilla.redhat.com/2345954","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7510.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-57970","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2025-6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57970.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345954","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7510.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-57970","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7510","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RH5NHSWEEGIGORCHOWYXBR3HCGWHTZPR/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57970","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-57970","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","status":"published","published":"2025-02-16T00:00:00Z","modified":"2025-02-18T17:05:13.914Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-53870","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","status":"published","published":"2025-02-16T00:00:00Z","modified":"2025-02-18T17:05:13Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:28.952595Z"}],"ghsa":[{"id":"GHSA-2q66-6w43-8rm9","title":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in...","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","status":"published","published":"2025-02-16T06:31:45Z","modified":"2025-02-16T06:31:46Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:59:57.660546Z"}],"nvd":[{"id":"CVE-2024-57970","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","status":"published","published":"2025-02-16T04:15:21.843Z","modified":"2026-06-17T08:14:20.697Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:10:44.508862Z"}],"osv":[{"id":"ALPINE-CVE-2024-57970","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","status":"published","published":"2025-02-16T04:15:21.843Z","modified":"2026-11-02T11:17:50.132029624Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-57970","status":"published","published":"2025-02-18T05:57:04.735205Z","modified":"2026-01-26T09:37:14.303792Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2024-57970","description":"libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","status":"published","published":"2025-02-16T00:00:00Z","modified":"2026-10-28T02:30:43.935241208Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"JLSEC-2025-250","title":"libarchive through 3.7.7 has a heap-based buffer over-read in `header_gnu_longlink` in...","description":"libarchive through 3.7.7 has a heap-based buffer over-read in `header_gnu_longlink` in `archive_read_support_format_tar.c` via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.","status":"published","published":"2025-11-25T22:03:17.636Z","modified":"2026-07-23T22:30:24.235988723Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"RHSA-2025:7510","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2025-05-14T10:06:46Z","modified":"2026-08-22T10:12:00Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7510","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: heap buffer over-read in header_gnu_longlink (CVE-2024-57970)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:38.353421Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ALSA-2025:7510","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: heap buffer over-read in header_gnu_longlink (CVE-2024-57970)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:13.917141Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"openSUSE-SU-2025:14844-1","title":"bsdtar-3.7.7-2.1 on GA media","description":"These are all security issues fixed in the bsdtar-3.7.7-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-27T00:00:00Z","modified":"2026-02-04T02:40:38.074435Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}