libarchive vulnerabilities

An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the 'libarchive' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted archive file.

An issue was discovered in certain Apple products, including macOS before 10.13.1, involving the 'libarchive' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted archive file.

An issue was discovered in certain Apple products, including macOS before 10.13.1, involving the 'libarchive' component. It allows remote attackers to execute arbitrary code or cause a denial of service via a crafted archive file.

The libarchive library version 3.3.2 has an off-by-one error in the read_header function affecting UTF-16 names in RAR archives. This can lead to an out-of-bounds read in the archive_read_format_rar_read_header function.

An issue was discovered in certain Apple products related to the 'libarchive' component. It affects iOS before 10.3.3, macOS before 10.12.6, tvOS before 10.2.2, and watchOS before 3.2.3, allowing remote attackers to execute arbitrary code or cause a denial of service.

The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.

A stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.

An error in the lha_read_file_header_1() function in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access, potentially causing a crash via a specially crafted archive.

libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted file.

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

The archive_read_format_cpio_read_header function in libarchive before version 3.2.1 allows remote attackers to cause an application crash via a CPIO archive with a large symlink.

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before version 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.

A stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before version 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.

Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before version 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, leading to a heap-based buffer overflow.

Multiple integer overflows in the get_time_t_max and get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before version 3.2.0 may allow remote attackers to trigger unspecified behavior via a crafted mtree file.

bsdtar in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.

The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.

The lha_read_file_extended_header function in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted lzh or lha file.

The archive_string_append function in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (crash) via crafted cab files, related to 'overlapping memcpy'.

bsdtar in libarchive before version 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.

A heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before version 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.

libarchive in Apple OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that conducts an unspecified symlink attack.

Windows libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

The execute_filter_audio function in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

The execute_filter_delta function in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

In libarchive before 3.6.2, the software does not check for an error after calling calloc, which can return a NULL pointer, leading to a NULL pointer dereference.

libarchive from version v3.2.0 onwards (commit 9693801580c0cf7c70e862d305270a16b52826a7) contains a CWE-20: Improper Input Validation vulnerability in the WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. The attack requires the victim to open a specially crafted WARC file.

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c (GHSA-92wx-p669-8gr9). This relates to bsdtar. Exploitation requires obtaining original-filename from an untrusted party.

Signed integer overflow vulnerability in libarchive's ZIP writer in archive_write_zip_header. When ZIP encryption is enabled and file size is near INT64_MAX, adding encryption overhead overflows int64_t, causing undefined behavior, potentially incorrect Zip64 decisions or memory corruption.

A flaw was found in libarchive that allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to denial of service or potentially arbitrary code execution.

A double free vulnerability has been found in libarchive's RAR5 reader. During processing of a specially crafted RAR5 archive, the filtered_buf pointer may become stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition.

Libarchive has a NULL pointer dereference vulnerability in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare 'd' or 'default' tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash.

An integer overflow vulnerability was found in libarchive on 32-bit systems in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, leading to a heap buffer overflow and potentially allowing arbitrary code execution.

A flaw was found in libarchive related to undefined behavior in the zisofs decompression logic, caused by improper validation of the `pz_log2_bs` field read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file, leading to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

A heap out-of-bounds read vulnerability was found in libarchive during RAR archive processing due to improper validation of the LZSS sliding window size after compression method transitions. A remote attacker can exploit this by providing a specially crafted RAR archive.

A flaw was found in the RAR5 archive decompression logic of the libarchive library, where processing a specially crafted archive causes an infinite loop that continuously consumes CPU resources. The archive passes checksum validation and appears structurally valid, so affected applications cannot detect the issue before processing.

A vulnerability has been identified in the libarchive library, triggered when file streams are piped into bsdtar, causing an out-of-bounds read. This can lead to unpredictable program behavior, memory corruption, or denial of service.

An off-by-one vulnerability has been identified in the libarchive library when handling file name prefixes and suffixes. This flaw causes a 1-byte write overflow, potentially corrupting adjacent memory and leading to unpredictable program behavior or crashes.

An integer overflow vulnerability has been identified in the libarchive library when processing WARC files claiming more than INT64_MAX - 4 content bytes. An attacker can craft a malicious WARC archive to trigger this overflow, leading to unpredictable behavior, memory corruption, or denial of service. This affects libarchive versions prior to 3.8.0.

A heap buffer over-read vulnerability has been identified in the libarchive library. The issue occurs when the size of a filter block exceeds the LZSS window, potentially causing the library to read beyond allocated memory, leading to unpredictable behavior, crashes, or disclosure of sensitive information.

A vulnerability was found in the libarchive library in the archive_read_format_rar_seek_data() function. An integer overflow leads to a double-free condition.

libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.