Summary
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
* libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028)
* libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | bsdtar | 3.7.7-11.el10_2 |
| AlmaLinux · 10 | libarchive | 3.7.7-11.el10_2 |
| AlmaLinux · 10 | libarchive-devel | 3.7.7-11.el10_2 |
Vulnerabilities 2
-
Low 3.9
Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file …
-
Low 2.9
Libarchive: libarchive: signed integer overflow in archive_write_zip_header
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encrypt…