{"id":"CVE-2025-25724","aliases":["ALPINE-CVE-2025-25724","ALSA-2025:9420","ALSA-2025:9431","AZL-57712","AZL-57720","BELL-CVE-2025-25724","CLSA-2025-1753377742","CLSA-2025-1754338412","CLSA-2025-1764235944","CLSA-2026-1787908647","DEBIAN-CVE-2025-25724","EUVD-2025-5869","GHSA-722w-734r-qg74","JLSEC-2025-243","MGASA-2025-0102","OESA-2025-1309","OESA-2025-1310","OESA-2025-1311","OESA-2025-1312","OESA-2025-1313","RHSA-2025:9420","RHSA-2025:9431","RHSA-2026:24383","RLSA-2025:9420","RLSA-2025:9431","SUSE-SU-2025:0985-1","SUSE-SU-2025:0986-1","SUSE-SU-2025:20257-1","UBUNTU-CVE-2025-25724","USN-7454-1","openSUSE-SU-2025:14882-1"],"status":"published","title":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return...","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00367,"percentile":0.30995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-252"],"published":"2025-03-02T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"bsdtar","fixed_in":["3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive","fixed_in":["3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libarchive-devel","fixed_in":["3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"bsdtar","fixed_in":["3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive","fixed_in":["3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libarchive-devel","fixed_in":["3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libarchive","fixed_in":["3.7.7-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libarchive","fixed_in":["3.6.1-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libarchive","fixed_in":["3.7.9-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"bsdcpio","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"bsdtar","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"libarchive","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"libarchive-devel","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","fixed_in":["3.5.3-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","fixed_in":["3.5.3-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","fixed_in":["3.5.3-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","fixed_in":["3.5.3-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","fixed_in":["3.5.3-4.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"bsdcpio","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"bsdtar","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libarchive","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libarchive-devel","fixed_in":["3.1.2-14.el7_7.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.8.4-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibArchive_jll","fixed_in":["3.7.9+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libarchive","fixed_in":["3.6.2-5.4.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libarchive","fixed_in":["3.5.2-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","fixed_in":["3.4.3-9.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libarchive","fixed_in":["3.5.2-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcat-debuginfo","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcpio-debuginfo","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar-debuginfo","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdunzip-debuginfo","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debuginfo","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debugsource","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-devel","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-devel","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcat-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcpio-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdtar-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debuginfo","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debugsource","fixed_in":["0:3.5.3-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"libarchive","fixed_in":["0:3.7.7-3.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"libarchive","fixed_in":["0:3.5.3-5.el9_6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","fixed_in":["3.5.1-150400.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libarchive","fixed_in":["3.5.1-150400.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libarchive","fixed_in":["3.5.1-150400.3.18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","fixed_in":["3.1.2-7ubuntu2.8+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","fixed_in":["3.1.2-11ubuntu0.16.04.8+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.7+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","fixed_in":["3.4.0-2ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.6.0-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","fixed_in":["3.7.2-2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libarchive","fixed_in":["3.7.7-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.1-r1"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.2-r1"},{"fixed":"3.7.9-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.el7_7.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-1","3.6.2-1+deb12u1","3.6.2-1+deb12u2","3.6.2-1+deb12u3","3.6.2-1+deb12u4","3.6.2-1+deb12u5","3.7.2-1","3.7.2-1.1","3.7.2-1.1~exp1","3.7.2-2","3.7.2-2.1","3.7.4-1","3.7.4-1.1","3.7.4-2","3.7.4-3","3.7.4-4","3.8.4-1","3.8.5-1","3.8.6-1","3.8.7-1","3.8.8-1","3.8.8-2","3.8.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.4-4","3.7.4-4+deb13u1","3.8.4-1","3.8.5-1","3.8.6-1","3.8.7-1","3.8.8-1","3.8.8-2","3.8.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-1"}]}],"versions":["3.7.4-4"]},{"source":"osv","ecosystem":"Julia","package":"LibArchive_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.9+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-5.4.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-6.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-6.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-9.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"bsdunzip-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.7-3.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-slfo.1.1_2.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm4"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1","3.1.2-7ubuntu2.8+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm2"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8","3.1.2-11ubuntu0.16.04.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm2"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7","3.2.2-3.1ubuntu0.7+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.4"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.4"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-0ubuntu2.1"}]}],"versions":["3.7.7-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.4"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.4"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-3.1"}]}],"bundled":2}],"products":[{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://github.com/Ekkosun/pocs/blob/main/bsdtarbug","tags":["Exploit","web","article","report"]},{"url":"https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752","tags":["Product","web","article","report"]},{"url":"https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92","tags":["Third Party Advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25724","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-722w-734r-qg74","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-25724","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9420","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-25724","tags":["report"]},{"url":"https://bugzilla.redhat.com/2349221","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-9420.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9431","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-9431.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-25724","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2025-6","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1753377742.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1754338412.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2025-1764235944.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787908647.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5121","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25724.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-25724","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0102.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34102","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2VPBSF65DTMKEEGFEJY6QEGJSZY7TSKV/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1309","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1310","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1632","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1311","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1312","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1313","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2349221","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9420.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-25724","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9431.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24383","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24383.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9420","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9431","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250985-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237606","tags":["report"]},{"url":"https://bugzilla.suse.com/1238610","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25724","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250986-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225971","tags":["report"]},{"url":"https://bugzilla.suse.com/1225972","tags":["report"]},{"url":"https://bugzilla.suse.com/1231544","tags":["report"]},{"url":"https://bugzilla.suse.com/1231624","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-20697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48958","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-25724","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7454-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8147-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-1632","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2VPBSF65DTMKEEGFEJY6QEGJSZY7TSKV/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-25724","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T00:00:00Z","modified":"2025-03-04T19:00:41.262Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2025-5869","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T00:00:00Z","modified":"2025-03-04T19:00:41Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:16.995722Z"}],"ghsa":[{"id":"GHSA-722w-734r-qg74","title":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return...","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T03:30:31Z","modified":"2025-03-02T03:30:37Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T15:00:06.147133Z"}],"nvd":[{"id":"CVE-2025-25724","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T02:15:36.603Z","modified":"2026-06-17T09:01:02.647Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T14:10:52.398004Z"}],"osv":[{"id":"ALPINE-CVE-2025-25724","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T02:15:36.603Z","modified":"2026-08-27T22:18:02.847753499Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-25724","status":"published","published":"2025-03-04T05:57:12.74366Z","modified":"2026-01-26T09:38:57.344933Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"CVE-2025-25724","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T00:00:00Z","modified":"2026-10-28T02:30:41.764865275Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-252"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-25724","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T02:15:36.603Z","modified":"2026-09-01T20:05:44.801980061Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"JLSEC-2025-243","title":"`list_item_verbose` in `tar/util.c` in libarchive through 3.7.7 does not check an strftime return...","description":"`list_item_verbose` in `tar/util.c` in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-11-25T22:03:17.636Z","modified":"2026-07-23T22:30:22.966856816Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2025-1309","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:17:50.076968271Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1310","title":"libarchive security update","description":" is an open-source BSD-licensed C programming library that \nprovides streaming access to a variety of different archive formats,\nincluding tar, cpio, pax, zip, and ISO9660 images. The distribution \nalso includes bsdtar and bsdcpio, full-featured implementations of \ntar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-1632)\n\nlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:17:49.96822289Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1311","title":"libarchive security update","description":" is an open-source BSD-licensed C programming library that \nprovides streaming access to a variety of different archive formats,\nincluding tar, cpio, pax, zip, and ISO9660 images. The distribution \nalso includes bsdtar and bsdcpio, full-featured implementations of \ntar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.(CVE-2025-1632)\n\nlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:17:50.023203963Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1312","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:17:49.995508704Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1313","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nlist_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.(CVE-2025-25724)","status":"published","published":"2025-03-21T11:08:24Z","modified":"2026-08-18T01:17:50.012095836Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:9420","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2025-06-24T10:03:12Z","modified":"2026-08-22T10:12:48Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:9431","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2025-06-25T10:06:24Z","modified":"2026-08-22T10:12:49Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2026:24383","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-06-09T10:08:34Z","modified":"2026-08-22T10:19:17Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RLSA-2025:9420","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:18:56.328303Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:9431","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:55.442456Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-25724","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T02:15:00Z","modified":"2026-04-22T15:40:04.305951Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:9420","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-24T00:00:00Z","modified":"2026-10-29T11:58:12.514713Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2025:9431","title":"Moderate: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-24T00:00:00Z","modified":"2026-10-29T11:32:30.036351006Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-57712","title":"CVE-2025-25724 affecting package libarchive for versions less than 3.7.7-2","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T02:15:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.162429Z"},{"id":"AZL-57720","title":"CVE-2025-25724 affecting package libarchive for versions less than 3.6.1-5","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.","status":"published","published":"2025-03-02T02:15:36Z","modified":"2026-04-21T04:36:59.297823Z","updated_at":"2026-11-02T15:28:07.209678Z"},{"id":"CLSA-2025-1753377742","title":"libarchive: Fix of CVE-2025-25724","description":"- CVE-2025-25724: fix buffer overflow vulnerability in libarchive","status":"published","published":"2025-07-24T17:22:26Z","modified":"2026-06-01T00:33:17.951296902Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1754338412","title":"libarchive: Fix of CVE-2025-25724","description":"- CVE-2025-25724: fix crash in list_item_verbose on invalid time","status":"published","published":"2025-08-04T20:13:35Z","modified":"2026-06-01T00:30:46.444513357Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1764235944","title":"libarchive: Fix of CVE-2025-25724","description":"- CVE-2025-25724: fix buffer overflow vulnerability in libarchive","status":"published","published":"2025-11-27T09:32:28Z","modified":"2026-06-01T00:33:14.209320568Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1787908647","title":"Fix of 8 CVEs","description":"   * SECURITY UPDATE: ACLs applied to a symbolic link modified the link\n     target instead\n     - debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic\n       link modified the link target instead\n     - CVE-2021-23177\n   * SECURITY UPDATE: symbolic links followed when changing modes, times,\n     ACLs and flags while extracting an archive\n     - debian/patches/CVE-2021-31566.patch: symbolic links followed when\n       changing modes, times, ACLs and flags while extracting an archive\n     - CVE-2021-31566\n   * SECURITY UPDATE: NULL pointer dereference when calloc() fails while\n     allocating a write filter\n     - debian/patches/CVE-2022-36227.patch: NULL pointer dereference when\n       calloc() fails while allocating a write filter\n     - CVE-2022-36227\n   * SECURITY UPDATE: integer overflow in the RAR4 reader allowing an\n     oversized memcpy in copy_from_lzss_window()\n     - debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4\n       reader allowing an oversized memcpy in copy_from_lzss_window()\n     - CVE-2024-20696\n   * SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the\n     RAR4 reader allowing an out-of-bounds read\n     - debian/patches/CVE-2026-4424.patch: LZSS window size mismatch\n       after a PPMd block in the RAR4 reader allowing an out-of-bounds\n       read\n     - CVE-2026-4424\n   * SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660\n     Rock Ridge ZF parser\n     - debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size\n       exponent in the ISO9660 Rock Ridge ZF parser\n     - CVE-2026-5121\n   * SECURITY UPDATE: double free in the RAR4 reader with over 4 billion\n     nodes\n     - debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader\n       with over 4 billion nodes\n     - CVE-2025-5914\n   * SECURITY UPDATE: unchecked strftime() return and localtime() NULL\n     dereference in the bsdtar verbose listing\n     - debian/patches/CVE-2025-25724.patch: check the strftime() result so a\n       custom locale whose expansion exceeds the 100-byte buffer cannot leave\n       stale content in it, and guard localtime() returning NULL; backports\n       upstream c9bc934e and ecce4674\n     - CVE-2025-25724\n   * Guard the RAR seek cursor before the previous-block lookup\n     - debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in\n       archive_read_format_rar_seek_data() before reading dbo[cursor - 1],\n       which would otherwise underflow; backports upstream e548c994\n   * Check the ISO9660 ZF entry length before reading its data bytes\n     - debian/patches/iso9660-zf-length-check.patch: test data_length before\n       data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry\n       cannot be read past the SUSP region bound; backports upstream a9a73c0e","status":"published","published":"2026-08-28T09:17:42Z","modified":"2026-10-26T09:43:54.435048564Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2025-0102","title":"Updated libarchive packages fix security vulnerability","description":"list_item_verbose in tar/util.c in libarchive through 3.7.7 does not\ncheck an strftime return value, which can lead to a denial of service or\nunspecified other impact via a crafted TAR archive that is read with a\nverbose value of 2. For example, the 100-byte buffer may not be\nsufficient for a custom locale. (CVE-2025-25724\n","status":"published","published":"2025-03-17T16:33:29Z","modified":"2026-04-16T04:43:22.529601246Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14882-1","title":"bsdtar-3.7.7-3.1 on GA media","description":"These are all security issues fixed in the bsdtar-3.7.7-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-12T00:00:00Z","modified":"2026-02-04T03:27:58.388458Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:0985-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)\n- CVE-2025-25724: Fixed buffer overflow vulnerability in function list_item_verbose() in tar/util.c (bsc#1238610)\n","status":"published","published":"2025-03-21T17:45:17Z","modified":"2026-02-04T04:20:34.52076Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0986-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2025-25724: Fixed buffer overflow vulnerability in function list_item_verbose() in tar/util.c (bsc#1238610).\n","status":"published","published":"2025-03-21T17:49:33Z","modified":"2026-02-04T03:39:22.285208Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20257-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- CVE-2025-1632: Fixed null pointer dereference in bsdunzip.c (bsc#1237606)\n- CVE-2025-25724: Fixed Buffer Overflow vulnerability in libarchive (bsc#1238610)\n- CVE-2024-48958: Fixed out-of-bounds access in execute_filter_delta (bsc#1231624)\n- CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability  (also attributed CVE-2024-26256) (CVE-2024-26256, bsc#1225972)\n- CVE-2024-48957: Fixed out-of-bounds access in execute_filter_audio (bsc#1231544)\n- CVE-2024-20696: Fixed heap based out-of-bounds write (bsc#1225971)\n\n","status":"published","published":"2025-03-31T14:21:24Z","modified":"2026-03-23T04:47:11.444555Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-7454-1","title":"libarchive vulnerabilities","description":"It was discovered that the libarchive bsdunzip utility incorrectly handled\ncertain ZIP archive files. If a user or automated system were tricked into\nprocessing a specially crafted ZIP archive, an attacker could use this\nissue to cause libarchive to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS,\nUbuntu 24.10, and Ubuntu 25.04. (CVE-2025-1632)\n\nIt was discovered that libarchive incorrectly handled certain TAR archive\nfiles. If a user or automated system were tricked into processing a\nspecially crafted TAR archive, an attacker could use this issue to cause\nlibarchive to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2025-25724)\n","status":"published","published":"2025-04-23T16:57:59Z","modified":"2026-04-22T10:57:25.114167Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}