Description
The libarchive library in FreeBSD 6-STABLE after 2006-09-05 and before 2006-11-08 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive that causes libarchive to skip a region past the actual end of the archive, which triggers an infinite loop that attempts to read more data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 1.3.1-1 | — |
| Debian 13 | libarchive | 1.3.1-1 | — |
| Debian 12 | libarchive | 1.3.1-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bsdtar | 3.5.1-1.5 | openSUSE-SU-2024:10925-1 |
Advisories 1
- openSUSE-SU-2024:10925-1 bsdtar-3.5.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 1017199 vdb-entry
- freebsd-libarchive-file-dos(30137) vdb-entry
- 22801 third-party-advisory
- 22723 third-party-advisory
- FreeBSD-SA-06:24 vendor-advisory
- 20961 vdb-entry