Summary
It was discovered that the libarchive bsdunzip utility incorrectly handled
certain ZIP archive files. If a user or automated system were tricked into
processing a specially crafted ZIP archive, an attacker could use this
issue to cause libarchive to crash, resulting in a denial of service, or
possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS,
Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-1632)
It was discovered that libarchive incorrectly handled certain TAR archive
files. If a user or automated system were tricked into processing a
specially crafted TAR archive, an attacker could use this issue to cause
libarchive to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2025-25724)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libarchive | 3.4.0-2ubuntu1.5 |
| Ubuntu · 22.04 LTS 22.04:LTS | libarchive | 3.6.0-1ubuntu1.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | libarchive | 3.7.2-2ubuntu0.4 |
Vulnerabilities 2
-
Medium 4.0
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to …
-
Low 3.3
libarchive bsdunzip.c list null pointer dereference
A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The e…