{"id":"CVE-2025-1632","aliases":["ALPINE-CVE-2025-1632","AZL-57156","BELL-CVE-2025-1632","DEBIAN-CVE-2025-1632","EUVD-2025-4364","GHSA-cw9m-pj72-3cj5","JLSEC-2025-242","OESA-2025-1310","OESA-2025-1311","SUSE-SU-2025:0985-1","SUSE-SU-2025:20257-1","UBUNTU-CVE-2025-1632","USN-7454-1","openSUSE-SU-2025:14882-1"],"status":"published","title":"libarchive bsdunzip.c list null pointer dereference","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00342,"percentile":0.27954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-404","CWE-476"],"published":"2025-02-24T13:31:08Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libarchive","fixed_in":["3.7.7-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.7.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.7.4-2"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibArchive_jll","fixed_in":["3.7.9+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","fixed_in":["3.7.2-2ubuntu0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-r1"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.2-r1"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-1","3.6.2-1+deb12u1","3.6.2-1+deb12u2","3.6.2-1+deb12u3","3.6.2-1+deb12u4","3.6.2-1+deb12u5","3.7.2-1","3.7.2-1.1","3.7.2-1.1~exp1","3.7.2-2","3.7.2-2.1","3.7.4-1","3.7.4-1.1","3.7.4-2","3.7.4-3","3.7.4-4","3.8.4-1","3.8.5-1","3.8.6-1","3.8.7-1","3.8.8-1","3.8.8-2","3.8.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-2"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibArchive_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.9+0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-6.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-6.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-slfo.1.1_2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.4"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.4"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.4"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-3.1"}]}],"bundled":2}],"products":[{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://vuldb.com/?id.296619","tags":["vdb-entry","technical-description","Permissions Required","VDB Entry","advisory","web","report"]},{"url":"https://vuldb.com/?ctiid.296619","tags":["signature","permissions-required","Permissions Required","VDB Entry","report","web"]},{"url":"https://vuldb.com/?submit.496460","tags":["third-party-advisory","Exploit","Third Party Advisory","VDB Entry","advisory","web","report"]},{"url":"https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc","tags":["exploit","Exploit","evidence","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1632","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cw9m-pj72-3cj5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-1632","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-1632","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2025-6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1632.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-1632","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1310","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25724","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1311","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250985-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237606","tags":["report"]},{"url":"https://bugzilla.suse.com/1238610","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25724","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225971","tags":["report"]},{"url":"https://bugzilla.suse.com/1225972","tags":["report"]},{"url":"https://bugzilla.suse.com/1231544","tags":["report"]},{"url":"https://bugzilla.suse.com/1231624","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48958","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-1632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1632","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7454-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-25724","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2VPBSF65DTMKEEGFEJY6QEGJSZY7TSKV/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-1632","title":"libarchive bsdunzip.c list null pointer dereference","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T13:31:08.871Z","modified":"2025-02-24T14:25:32.542Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"},{"version":"3.0","score":3.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"},{"version":"2.0","score":1.7,"vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","assessor":"cna"}],"cwes":["CWE-476","CWE-404"],"updated_at":"2026-11-02T14:32:49.824855Z"}],"euvd":[{"id":"EUVD-2025-4364","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T13:31:08Z","modified":"2025-02-24T14:25:32Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:53:25.517067Z"}],"ghsa":[{"id":"GHSA-cw9m-pj72-3cj5","title":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This...","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T15:30:49Z","modified":"2025-03-25T18:30:49Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-404","CWE-476"],"updated_at":"2026-11-02T15:00:26.443231Z"}],"nvd":[{"id":"CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T14:15:11.59Z","modified":"2026-06-17T08:39:30.083Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":1.7,"vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","level":"low","assessor":"secondary"}],"cwes":["CWE-404","CWE-476"],"updated_at":"2026-11-02T14:10:51.871789Z"}],"osv":[{"id":"ALPINE-CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T14:15:11.59Z","modified":"2026-08-27T22:18:02.776935055Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-57156","title":"CVE-2025-1632 affecting package libarchive for versions less than 3.7.7-2","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T14:15:11Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"BELL-CVE-2025-1632","status":"published","published":"2025-02-25T05:57:51.27816Z","modified":"2026-01-26T09:38:40.869251Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-1632","title":"libarchive bsdunzip.c list null pointer dereference","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T13:31:08.871Z","modified":"2026-10-28T02:31:10.657404086Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-404","CWE-476"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T14:15:11.59Z","modified":"2026-09-01T20:05:41.51330562Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"JLSEC-2025-242","title":"A vulnerability was found in libarchive up to 3.7.7","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-11-25T22:03:17.636Z","modified":"2026-07-18T00:00:17.402614736Z","cvss":[{"version":"2.0","score":1.7,"vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","level":"low"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2025-1310","title":"libarchive security update","description":" is an open-source BSD-licensed C programming library that \nprovides streaming access to a variety of different archive formats,\nincluding tar, cpio, pax, zip, and ISO9660 images. The distribution \nalso includes bsdtar and bsdcpio, full-featured implementations of \ntar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-1632)\n\nlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:17:49.96822289Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1311","title":"libarchive security update","description":" is an open-source BSD-licensed C programming library that \nprovides streaming access to a variety of different archive formats,\nincluding tar, cpio, pax, zip, and ISO9660 images. The distribution \nalso includes bsdtar and bsdcpio, full-featured implementations of \ntar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-1632)\n\nlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:17:50.023203963Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-1632","description":"A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2025-02-24T14:15:00Z","modified":"2026-04-22T15:32:42.963495Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"openSUSE-SU-2025:14882-1","title":"bsdtar-3.7.7-3.1 on GA media","description":"These are all security issues fixed in the bsdtar-3.7.7-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2026-02-04T03:27:58.388458Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:0985-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)\n- CVE-2025-25724: Fixed buffer overflow vulnerability in function list_item_verbose() in tar/util.c (bsc#1238610)\n","status":"published","published":"2025-03-21T17:45:17Z","modified":"2026-02-04T04:20:34.52076Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20257-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)\n- CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)\n- CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)\n- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability  (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)\n- CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)\n\n","status":"published","published":"2025-03-31T14:21:24Z","modified":"2026-03-23T04:47:11.444555Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7454-1","title":"libarchive vulnerabilities","description":"It was discovered that the libarchive bsdunzip utility incorrectly handled\ncertain ZIP archive files. If a user or automated system were tricked into\nprocessing a specially crafted ZIP archive, an attacker could use this\nissue to cause libarchive to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS,\nUbuntu 24.10, and Ubuntu 25.04. (CVE-2025-1632)\n\nIt was discovered that libarchive incorrectly handled certain TAR archive\nfiles. If a user or automated system were tricked into processing a\nspecially crafted TAR archive, an attacker could use this issue to cause\nlibarchive to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2025-25724)\n","status":"published","published":"2025-04-23T16:57:59Z","modified":"2026-04-22T10:57:25.114167Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}