Vulnerabilities > Libarchive > High

DATE CVE VULNERABILITY TITLE RISK
2024-10-10 CVE-2024-48957 Out-of-bounds Read vulnerability in Libarchive
execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
local
low complexity
libarchive CWE-125
7.8
2024-10-10 CVE-2024-48958 Out-of-bounds Read vulnerability in Libarchive
execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
local
low complexity
libarchive CWE-125
7.8
2022-08-23 CVE-2021-23177 Link Following vulnerability in multiple products
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link.
7.8
2022-08-23 CVE-2021-31566 Link Following vulnerability in multiple products
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive.
7.8
2020-02-20 CVE-2020-9308 Out-of-bounds Write vulnerability in multiple products
archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.
network
low complexity
libarchive canonical fedoraproject CWE-787
8.8
2019-10-24 CVE-2019-18408 Use After Free vulnerability in multiple products
archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.
network
low complexity
libarchive debian canonical CWE-416
7.5
2018-12-20 CVE-2018-1000878 Use After Free vulnerability in multiple products
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible.
8.8
2018-12-20 CVE-2018-1000877 Double Free vulnerability in multiple products
libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS.
8.8
2017-09-17 CVE-2017-14502 Off-by-one Error vulnerability in Libarchive 3.3.2
read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.
network
low complexity
libarchive CWE-193
7.5
2017-02-15 CVE-2016-8689 Out-of-bounds Read vulnerability in multiple products
The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
network
low complexity
libarchive opensuse CWE-125
7.5