{"id":"SUSE-SU-2026:23309-1","aliases":[],"status":"published","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- Fix creation of temporary files in target directory (bsc#1254340)\n- Fix out-of-bounds buffer overrun when using p[H_LEVEL_OFFSET] (bsc#1254341)\n- Fix buffer overrun in archive_le32dec when reading truncated 7zip headers (bsc#1254342)\n- Fix NULL pointer dereference in archive_acl_from_text_w() (bsc#1260998)\n- Fix SEGV in check_7zip_header_in_sfx via ELF offset validation (bsc#1260999)\n- Fix out-of-bounds access on ELF 64-bit header (bsc#1261000)\n- Fix RAR5 memory leak with many filters (bsc#1261002)\n- Fix file descriptor leak in mtree parser cleanup (bsc#1261003)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-24T18:51:05Z","modified":"2026-09-10T18:23:09Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libarchive","fixed_in":["3.8.1-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libarchive","fixed_in":["3.8.1-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-160000.4.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623309-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254340","tags":["report"]},{"url":"https://bugzilla.suse.com/1254341","tags":["report"]},{"url":"https://bugzilla.suse.com/1254342","tags":["report"]},{"url":"https://bugzilla.suse.com/1260998","tags":["report"]},{"url":"https://bugzilla.suse.com/1260999","tags":["report"]},{"url":"https://bugzilla.suse.com/1261000","tags":["report"]},{"url":"https://bugzilla.suse.com/1261002","tags":["report"]},{"url":"https://bugzilla.suse.com/1261003","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2026:23309-1","title":"Security update for libarchive","description":"This update for libarchive fixes the following issues:\n\n- Fix creation of temporary files in target directory (bsc#1254340)\n- Fix out-of-bounds buffer overrun when using p[H_LEVEL_OFFSET] (bsc#1254341)\n- Fix buffer overrun in archive_le32dec when reading truncated 7zip headers (bsc#1254342)\n- Fix NULL pointer dereference in archive_acl_from_text_w() (bsc#1260998)\n- Fix SEGV in check_7zip_header_in_sfx via ELF offset validation (bsc#1260999)\n- Fix out-of-bounds access on ELF 64-bit header (bsc#1261000)\n- Fix RAR5 memory leak with many filters (bsc#1261002)\n- Fix file descriptor leak in mtree parser cleanup (bsc#1261003)\n","status":"published","published":"2026-08-24T18:51:05Z","modified":"2026-09-10T18:23:09.579582397Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}