{"id":"CVE-2026-5121","aliases":["ALSA-2026:8510","ALSA-2026:8534","AZL-81504","BELL-CVE-2026-5121","CLSA-2026-1777365744","CLSA-2026-1777366496","CLSA-2026-1787908647","CLSA-2026-1792167585","CLSA-2026-1792818643","DEBIAN-CVE-2026-5121","EUVD-2026-17073","GHSA-2vwv-vqpv-v8vc","MGASA-2026-0241","MGASA-2026-0366","OESA-2026-1940","OESA-2026-1941","OESA-2026-1942","OESA-2026-1943","OESA-2026-1944","OESA-2026-1945","RHSA-2026:8510","RHSA-2026:8517","RHSA-2026:8521","RHSA-2026:8534","RHSA-2026:8864","RHSA-2026:8866","RHSA-2026:8867","RHSA-2026:8873","RHSA-2026:8908","RHSA-2026:8944","RHSA-2026:9026","RHSA-2026:9592","RLSA-2026:8510","RLSA-2026:8534","ROOT-OS-ALPINE-323-CVE-2026-5121","SUSE-SU-2026:21757-1","SUSE-SU-2026:21831-1","SUSE-SU-2026:22241-1","SUSE-SU-2026:22248-1","SUSE-SU-2026:2490-1","SUSE-SU-2026:2599-1","SUSE-SU-2026:2747-1","UBUNTU-CVE-2026-5121","USN-8292-1","openSUSE-SU-2026:20797-1"],"status":"published","title":"Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01092,"percentile":0.65648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-03-30T07:47:28Z","modified":"2026-11-05T22:18:49Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libarchive","fixed_in":["3.7.7-6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","fixed_in":["3.5.3-6.el9_2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","fixed_in":["3.5.3-6.el9_2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","fixed_in":["3.5.3-6.el9_2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","fixed_in":["3.5.3-6.el9_2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","fixed_in":["3.5.3-6.el9_2.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcat","fixed_in":["3.5.3-6.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcpio","fixed_in":["3.5.3-6.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdtar","fixed_in":["3.5.3-6.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive","fixed_in":["3.5.3-6.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive-devel","fixed_in":["3.5.3-6.el9_6.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libarchive","fixed_in":["3.6.2-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libarchive","fixed_in":["3.7.4-4+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libarchive","fixed_in":["3.8.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","fixed_in":["3.1.2-7ubuntu2.8+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","fixed_in":["3.1.2-11ubuntu0.16.04.8+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","fixed_in":["3.2.2-3.1ubuntu0.7+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","fixed_in":["3.4.0-2ubuntu1.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","fixed_in":["3.6.0-1ubuntu1.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","fixed_in":["3.7.2-2ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libarchive","fixed_in":["3.7.7-0ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libarchive","fixed_in":["3.8.5-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_2.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.el9_6.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libarchive13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+tuxcare.els1"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.0.4.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.0.4.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.0.4.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-14.0.4.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3-7.el6_8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3-7.el6_8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1+deb12u4"}]}],"versions":["3.6.2-1","3.6.2-1+deb12u1","3.6.2-1+deb12u2","3.6.2-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-4+deb13u1"}]}],"versions":["3.7.4-4"]},{"source":"osv","ecosystem":"Debian:14","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.7-1"}]}],"versions":["3.7.4-4","3.8.4-1","3.8.5-1","3.8.6-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.8-1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-5.6.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-14.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-13.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-11.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-11.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-11.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-11.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"bsdcpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-14.el7_9.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.2-8.el8_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-7.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-2.el9_0.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-5.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-6.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.7-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libarchive-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.8.7-1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-5.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bsdcat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bsdcpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bsdtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"bsdtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libarchive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"libarchive-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-1.el8_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-9.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.3-7.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-slfo.1.1_4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-150600.3.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-150400.3.24.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-32.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm5"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1","3.1.2-7ubuntu2.8+esm3","3.1.2-7ubuntu2.8+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm3"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8","3.1.2-11ubuntu0.16.04.8+esm1","3.1.2-11ubuntu0.16.04.8+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm3"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7","3.2.2-3.1ubuntu0.7+esm1","3.2.2-3.1ubuntu0.7+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5+esm2"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4","3.4.0-2ubuntu1.5","3.4.0-2ubuntu1.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.7"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3","3.6.0-1ubuntu1.4","3.6.0-1ubuntu1.5","3.6.0-1ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.7"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3","3.7.2-2ubuntu0.4","3.7.2-2ubuntu0.5","3.7.2-2ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-0ubuntu3.2"}]}],"versions":["3.7.7-0ubuntu2","3.7.7-0ubuntu2.1","3.7.7-0ubuntu2.2","3.7.7-0ubuntu3","3.7.7-0ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.5-1ubuntu2.1"}]}],"versions":["3.7.7-0ubuntu3","3.8.5-1ubuntu1","3.8.5-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-7ubuntu2.8+esm5"}]}],"versions":["3.1.2-5ubuntu1","3.1.2-7ubuntu1","3.1.2-7ubuntu2","3.1.2-7ubuntu2.1","3.1.2-7ubuntu2.2","3.1.2-7ubuntu2.3","3.1.2-7ubuntu2.4","3.1.2-7ubuntu2.6","3.1.2-7ubuntu2.7","3.1.2-7ubuntu2.8","3.1.2-7ubuntu2.8+esm1","3.1.2-7ubuntu2.8+esm3","3.1.2-7ubuntu2.8+esm4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-11ubuntu0.16.04.8+esm3"}]}],"versions":["3.1.2-11build1","3.1.2-11ubuntu0.16.04.1","3.1.2-11ubuntu0.16.04.2","3.1.2-11ubuntu0.16.04.3","3.1.2-11ubuntu0.16.04.4","3.1.2-11ubuntu0.16.04.5","3.1.2-11ubuntu0.16.04.6","3.1.2-11ubuntu0.16.04.7","3.1.2-11ubuntu0.16.04.8","3.1.2-11ubuntu0.16.04.8+esm1","3.1.2-11ubuntu0.16.04.8+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-3.1ubuntu0.7+esm3"}]}],"versions":["3.2.2-3.1","3.2.2-3.1ubuntu0.1","3.2.2-3.1ubuntu0.2","3.2.2-3.1ubuntu0.3","3.2.2-3.1ubuntu0.4","3.2.2-3.1ubuntu0.5","3.2.2-3.1ubuntu0.6","3.2.2-3.1ubuntu0.7","3.2.2-3.1ubuntu0.7+esm1","3.2.2-3.1ubuntu0.7+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-2ubuntu1.5+esm2"}]}],"versions":["3.4.0-1","3.4.0-1build1","3.4.0-1ubuntu2","3.4.0-2ubuntu1","3.4.0-2ubuntu1.1","3.4.0-2ubuntu1.2","3.4.0-2ubuntu1.3","3.4.0-2ubuntu1.4","3.4.0-2ubuntu1.5","3.4.0-2ubuntu1.5+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1ubuntu1.7"}]}],"versions":["3.4.3-2","3.4.3-2build1","3.5.2-1","3.5.2-1ubuntu1","3.6.0-1ubuntu1","3.6.0-1ubuntu1.1","3.6.0-1ubuntu1.2","3.6.0-1ubuntu1.3","3.6.0-1ubuntu1.4","3.6.0-1ubuntu1.5","3.6.0-1ubuntu1.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.2-2ubuntu0.7"}]}],"versions":["3.6.2-1ubuntu1","3.7.2-1ubuntu1","3.7.2-1ubuntu2","3.7.2-1.1ubuntu2","3.7.2-2","3.7.2-2ubuntu0.1","3.7.2-2ubuntu0.2","3.7.2-2ubuntu0.3","3.7.2-2ubuntu0.4","3.7.2-2ubuntu0.5","3.7.2-2ubuntu0.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.7-0ubuntu3.2"}]}],"versions":["3.7.7-0ubuntu2","3.7.7-0ubuntu2.1","3.7.7-0ubuntu2.2","3.7.7-0ubuntu3","3.7.7-0ubuntu3.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.5-1ubuntu2.1"}]}],"versions":["3.7.7-0ubuntu3","3.8.5-1ubuntu1","3.8.5-1ubuntu2"],"bundled":3}],"products":[{"vendor":"libarchive","product":"libarchive"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.17"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.18"},{"vendor":"red hat","product":"cert manager support for red hat openshift release 1.20"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.2 advanced update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat insights proxy 1.5"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat update infrastructure 5"},{"vendor":"red hat","product":"rhel-8 based middleware containers"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"hardened_images"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"siemens","product":"sidis secured smartplug"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:10065","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10097","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11768","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12071","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12274","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13812","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14773","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14937","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:15087","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16008","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16009","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16030","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16174","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17596","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19724","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19725","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20040","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21690","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25096","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72502","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82304","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82322","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82347","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82354","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82372","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82857","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82888","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8510","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8517","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8521","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8534","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8864","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8866","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8867","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8873","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8908","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8944","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9026","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9592","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9832","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5121","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452945","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/advisories/GHSA-2vwv-vqpv-v8vc","tags":["Third Party Advisory","advisory"]},{"url":"https://github.com/libarchive/libarchive/pull/2934","tags":["Issue Tracking","Patch","article","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-585531.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5121","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4424","tags":["report"]},{"url":"https://bugzilla.redhat.com/2449006","tags":["report"]},{"url":"https://bugzilla.redhat.com/2452945","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-8510.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-8534.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-5121","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1777365744.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777366496.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787908647.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-20696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4424","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792167585.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1792818643.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5121","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0241.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35836","tags":["report"]},{"url":"https://github.com/libarchive/libarchive/releases/tag/v3.8.8","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2026-0366.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35999","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8581-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4426","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1941","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1942","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1943","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1944","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1945","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449006","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8510.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4424","tags":["advisory"]},{"url":"https://github.com/libarchive/libarchive/pull/2898","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5121","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8517.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8521.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8534.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8864.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8866.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8867.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8873.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8908.json","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-60753","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4111","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5745","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4426","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8944.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2412648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-60753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60753","tags":["advisory"]},{"url":"https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753","tags":["article"]},{"url":"https://github.com/libarchive/libarchive/issues/2725","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446453","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4111","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4111","tags":["advisory"]},{"url":"https://github.com/libarchive/libarchive/pull/2877","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4426","tags":["advisory"]},{"url":"https://github.com/libarchive/libarchive/pull/2897","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5745","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9026.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9592.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:8510","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:8534","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621757-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259635","tags":["report"]},{"url":"https://bugzilla.suse.com/1259928","tags":["report"]},{"url":"https://bugzilla.suse.com/1259931","tags":["report"]},{"url":"https://bugzilla.suse.com/1261186","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5121","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621831-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622241-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253088","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-60753","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622248-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262490-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262599-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262747-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-5121","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8292-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-4424","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4426","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-5121","title":"Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","status":"published","published":"2026-03-30T07:47:28.562Z","modified":"2026-11-05T21:17:49.872Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-190","CWE-190"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-17073","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","status":"published","published":"2026-03-30T07:47:28Z","modified":"2026-11-05T21:17:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T22:02:08.543452Z"}],"ghsa":[{"id":"GHSA-2vwv-vqpv-v8vc","title":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in...","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","status":"published","published":"2026-03-30T09:31:29Z","modified":"2026-10-14T21:33:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:13:29.286626Z"}],"nvd":[{"id":"CVE-2026-5121","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","status":"published","published":"2026-03-30T08:16:18.78Z","modified":"2026-11-05T22:18:49.677Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-05T23:57:17.922269Z"}],"osv":[{"id":"BELL-CVE-2026-5121","title":"CVE-2026-5121 does not affect BellSoft software","status":"withdrawn","published":"2026-03-31T06:09:07.289171Z","modified":"2026-04-25T07:21:20.069707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"DEBIAN-CVE-2026-5121","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","status":"published","published":"2026-03-30T08:16:18.78Z","modified":"2026-10-15T09:47:27.092957726Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"OESA-2026-1940","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)\n\nA flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)","status":"published","published":"2026-04-17T11:10:57Z","modified":"2026-08-18T01:19:39.213896177Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1941","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)\n\nA flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)","status":"published","published":"2026-04-17T11:10:57Z","modified":"2026-08-18T01:19:47.730191167Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1942","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)\n\nA flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)\n\nA flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)","status":"published","published":"2026-04-17T11:10:57Z","modified":"2026-08-18T01:19:39.269541803Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1943","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)\n\nA flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)\n\nA flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)","status":"published","published":"2026-04-17T11:10:57Z","modified":"2026-08-18T01:19:39.267500825Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1944","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)\n\nA flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)\n\nA flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)","status":"published","published":"2026-04-17T11:10:57Z","modified":"2026-08-18T01:19:39.273651192Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1945","title":"libarchive security update","description":"is an open-source BSD-licensed C programming library that  provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution  also includes bsdtar and bsdcpio, full-featured implementations of  tar and cpio that use .\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.(CVE-2026-4424)\n\nA flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.(CVE-2026-4426)\n\nA flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.(CVE-2026-5121)","status":"published","published":"2026-04-17T11:10:57Z","modified":"2026-08-18T01:19:47.885989276Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:8510","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-17T10:09:40Z","modified":"2026-10-15T10:29:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8517","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-17T10:09:40Z","modified":"2026-10-15T10:29:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8521","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-17T10:09:41Z","modified":"2026-10-15T10:29:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8534","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-17T10:09:41Z","modified":"2026-10-15T10:29:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8864","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-20T10:12:27Z","modified":"2026-10-15T10:29:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8866","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-20T10:12:28Z","modified":"2026-10-15T10:29:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8867","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-20T10:12:28Z","modified":"2026-10-15T10:29:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8873","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-20T10:12:31Z","modified":"2026-10-15T10:29:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8908","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-20T10:12:39Z","modified":"2026-10-15T10:29:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:8944","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:10:50Z","modified":"2026-10-15T10:29:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9026","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-21T10:10:51Z","modified":"2026-10-15T10:29:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9592","title":"Red Hat Security Advisory: libarchive security update","status":"published","published":"2026-04-22T10:11:31Z","modified":"2026-10-15T10:29:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2026:8510","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)\n\n* libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-19T00:04:03.62289Z","modified":"2026-04-19T00:30:26.162541Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:8534","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.\n\nSecurity Fix(es):\n\n* libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)\n\n* libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-18T12:00:50.829789Z","modified":"2026-04-18T12:30:35.036604Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-5121","title":"CVE-2026-5121 in libarchive - Patched by Root","description":"Root has patched CVE-2026-5121 in the libarchive package for Root:Alpine:3.23. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-29T09:16:39Z","modified":"2026-10-20T13:00:04.938733262Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"UBUNTU-CVE-2026-5121","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","status":"published","published":"2026-03-30T08:16:00Z","modified":"2026-05-21T19:46:31.529381452Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"ALSA-2026:8510","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)\n  * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-16T00:00:00Z","modified":"2026-10-29T11:32:38.289598634Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:8534","title":"Important: libarchive security update","description":"The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.  \n\nSecurity Fix(es):  \n\n  * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424)\n  * libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing (CVE-2026-5121)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-16T00:00:00Z","modified":"2026-10-29T11:02:25.321300329Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-81504","title":"CVE-2026-5121 affecting package libarchive for versions less than 3.7.7-6","description":"A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.","status":"published","published":"2026-03-30T08:16:18Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1777365744","title":"libarchive: Fix of CVE-2026-5121","description":"- Fix CVE-2026-5121: heap buffer overflow in ISO9660 reader via invalid\n  pz_log2_bs value in Rock Ridge ZF extension","status":"published","published":"2026-05-14T09:11:59Z","modified":"2026-06-01T00:32:28.104745042Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777366496","title":"libarchive: Fix of CVE-2026-5121","description":"- Fix CVE-2026-5121: heap buffer overflow in ISO9660 reader via invalid\n  pz_log2_bs value in Rock Ridge ZF extension","status":"published","published":"2026-04-28T08:55:01Z","modified":"2026-06-01T00:32:48.819053183Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1787908647","title":"Fix of 8 CVEs","description":"   * SECURITY UPDATE: ACLs applied to a symbolic link modified the link\n     target instead\n     - debian/patches/CVE-2021-23177.patch: ACLs applied to a symbolic\n       link modified the link target instead\n     - CVE-2021-23177\n   * SECURITY UPDATE: symbolic links followed when changing modes, times,\n     ACLs and flags while extracting an archive\n     - debian/patches/CVE-2021-31566.patch: symbolic links followed when\n       changing modes, times, ACLs and flags while extracting an archive\n     - CVE-2021-31566\n   * SECURITY UPDATE: NULL pointer dereference when calloc() fails while\n     allocating a write filter\n     - debian/patches/CVE-2022-36227.patch: NULL pointer dereference when\n       calloc() fails while allocating a write filter\n     - CVE-2022-36227\n   * SECURITY UPDATE: integer overflow in the RAR4 reader allowing an\n     oversized memcpy in copy_from_lzss_window()\n     - debian/patches/CVE-2024-20696.patch: integer overflow in the RAR4\n       reader allowing an oversized memcpy in copy_from_lzss_window()\n     - CVE-2024-20696\n   * SECURITY UPDATE: LZSS window size mismatch after a PPMd block in the\n     RAR4 reader allowing an out-of-bounds read\n     - debian/patches/CVE-2026-4424.patch: LZSS window size mismatch\n       after a PPMd block in the RAR4 reader allowing an out-of-bounds\n       read\n     - CVE-2026-4424\n   * SECURITY UPDATE: unvalidated zisofs block size exponent in the ISO9660\n     Rock Ridge ZF parser\n     - debian/patches/CVE-2026-5121.patch: unvalidated zisofs block size\n       exponent in the ISO9660 Rock Ridge ZF parser\n     - CVE-2026-5121\n   * SECURITY UPDATE: double free in the RAR4 reader with over 4 billion\n     nodes\n     - debian/patches/CVE-2025-5914.patch: double free in the RAR4 reader\n       with over 4 billion nodes\n     - CVE-2025-5914\n   * SECURITY UPDATE: unchecked strftime() return and localtime() NULL\n     dereference in the bsdtar verbose listing\n     - debian/patches/CVE-2025-25724.patch: check the strftime() result so a\n       custom locale whose expansion exceeds the 100-byte buffer cannot leave\n       stale content in it, and guard localtime() returning NULL; backports\n       upstream c9bc934e and ecce4674\n     - CVE-2025-25724\n   * Guard the RAR seek cursor before the previous-block lookup\n     - debian/patches/rar-guard-seek-cursor.patch: reject a zero cursor in\n       archive_read_format_rar_seek_data() before reading dbo[cursor - 1],\n       which would otherwise underflow; backports upstream e548c994\n   * Check the ISO9660 ZF entry length before reading its data bytes\n     - debian/patches/iso9660-zf-length-check.patch: test data_length before\n       data[0]/data[1] in parse_rockridge_ZF1(), so a zero-length ZF entry\n       cannot be read past the SUSP region bound; backports upstream a9a73c0e","status":"published","published":"2026-08-28T09:17:42Z","modified":"2026-10-26T09:43:54.435048564Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792167585","title":"libarchive: Fix of 7 CVEs","description":"- Rebase onto Oracle 3.1.2-14.0.3.el7_9: take Oracle's CVE-2025-5914,\n  CVE-2026-4424 and CVE-2026-5121 patches in place of ours; keep only the\n  extra CVE-2026-4424 copy_from_lzss_window() bounds check\n- Build el7 targets with the .el7_9 dist","status":"published","published":"2026-10-16T16:20:02Z","modified":"2026-10-26T09:31:59.438701157Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792818643","title":"libarchive: Fix of 2 CVEs","description":"- CVE-2021-23177: fix extraction of ACLs to the symlink target instead of the link\n- CVE-2021-31566: do not follow symlinks when fixing up permissions and file flags\n- CVE-2026-5121: validate pz_log2_bs in the iso9660 zisofs reader","status":"published","published":"2026-10-24T05:10:55Z","modified":"2026-10-26T09:31:53.775116996Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0241","title":"Updated libarchive packages fix security vulnerabilities","description":"The updated packages fix bugs including security ones.\n","status":"published","published":"2026-07-11T20:43:25Z","modified":"2026-07-11T20:45:04.766306553Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0366","title":"Updated libarchive packages fix security vulnerabilities","description":"Double-free vulnerability in rar5 decompression logic via dangling\nfiltered_buf pointer in init_unpack(). (CVE-2026-14164)\nHeap overflow oob read while parsing a tar archive contains a pax\nextended header. (CVE-2026-15028)\nA null pointer dereference vulnerability exists in the acl parser of\nlibarchive. (CVE-2026-5745)\nReading past eof may be triggered for piped file streams.\n(CVE-2025-5918)\nAn issue was discovered in libarchive bsdtar before version 3.8.1 in\nfunction apply_substitution in file tar/subst.c when processing crafted\n-s substitution rules. This can cause unbounded memory allocation and\nlead to denial of service (Out-of-Memory crash). (CVE-2025-60753)\nInfinite loop denial of service in rar5 decompression via\narchive_read_data() in libarchive. (CVE-2026-4111)\nInformation disclosure via heap out-of-bounds read in rar archive\nprocessing. (CVE-2026-4424)\nDenial of service via malformed iso file processing. (CVE-2026-4426)\nArbitrary code execution via integer overflow in iso9660 image\nprocessing. (CVE-2026-5121)\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:11:17.793563615Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:20797-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).\n","status":"published","published":"2026-05-25T07:40:16Z","modified":"2026-05-28T18:24:16.320109375Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21757-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).\n","status":"published","published":"2026-05-25T07:42:39Z","modified":"2026-05-27T18:24:07.334293113Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21831-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).\n","status":"published","published":"2026-05-25T07:42:39Z","modified":"2026-05-28T18:24:13.454050961Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22241-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-18T08:00:49Z","modified":"2026-06-26T18:24:10.318829274Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22248-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-22T09:04:46Z","modified":"2026-06-26T18:24:14.275714745Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2490-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-22T12:34:31Z","modified":"2026-06-24T09:00:13.168795898Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2599-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop\n  and DoS (bsc#1259635).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-06-23T15:41:04Z","modified":"2026-06-24T09:00:18.645923961Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2747-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues\n\n- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).\n- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).\n- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code\n  (bsc#1259931).\n- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).\n","status":"published","published":"2026-07-03T11:46:40Z","modified":"2026-07-04T08:30:06.169095866Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8292-1","title":"libarchive vulnerabilities","description":"It was discovered that libarchive incorrectly handled certain RAR\narchives. An attacker could possibly use this issue to cause an\nout-of-bounds read via a crafted RAR archive, leading to sensitive\nmemory disclosure. (CVE-2026-4424)\n\nIt was discovered that libarchive incorrectly handled certain ISO files.\nAn attacker could possibly use this issue to cause incorrect memory\nallocation via a crafted ISO file, leading to a denial of service.\n(CVE-2026-4426)\n\nIt was discovered that libarchive incorrectly handled block pointer\nallocation in zisofs on 32-bit systems. An attacker could possibly use\nthis issue to cause a heap buffer overflow via a crafted ISO9660 image,\npossibly leading to arbitrary code execution. (CVE-2026-5121)","status":"published","published":"2026-05-21T14:28:35Z","modified":"2026-05-21T21:32:57.062127362Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}