Description
Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.1.2-11 | — |
| Debian 13 | libarchive | 3.1.2-11 | — |
| Debian 12 | libarchive | 3.1.2-11 | — |
| Debian 7 | libarchive | 3.0.4-3+wheezy1 | DSA-3180-1 |
| Debian 6.0 | libarchive | 2.8.4.forreal-1+squeeze3 | DLA-166-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libarchive | 3.1.2-7ubuntu2.1 | USN-2549-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | libarchive | 3.1.2-25.1 | SUSE-SU-2016:2911-1 |
| SLES 12 SP1 | libarchive | 3.1.2-25.1 | SUSE-SU-2016:2911-1 |
| SLES 12 | libarchive | 3.1.2-9.1 | SUSE-SU-2015:0667-1 |
| SLES 11 SP4 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
| SLES 11 SP3 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP2 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
| SUSE Studio Onsite 1.3 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
| SLES for SAP 12 SP2 | libarchive | 3.1.2-25.1 | SUSE-SU-2016:2911-1 |
| SLES for SAP 12 SP1 | libarchive | 3.1.2-25.1 | SUSE-SU-2016:2911-1 |
| SLES for SAP 12 | libarchive | 3.1.2-9.1 | SUSE-SU-2015:0667-1 |
| SLES for SAP 11 SP4 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
| SUSE OpenStack Cloud 5 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
| SUSE Manager Proxy 2.1 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
| SUSE Manager 2.1 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | bsdtar | 2.5.5-9.1 | SUSE-SU-2016:1939-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bsdtar | 3.2.2-2.1 | openSUSE-SU-2024:10127-1 |
Advisories 7
- USN-2549-1 libarchive vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-166-1 libarchive - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3180-1 libarchive - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2015:0667-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10127-1 bsdtar-3.2.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2911-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1939-1 Security update for bsdtar SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 1035996 vdb-entry
- http://advisories.mageia.org/MGASA-2015-0106.html
- https://github.com/libarchive/libarchive/commit/59357157706d47c365b2227739e17daba3607526
- openSUSE-SU-2015:0568 vendor-advisory
- https://github.com/libarchive/libarchive/pull/110
- FreeBSD-SA-16:22 vendor-advisory
- [oss-security] 20150116 CVE Request: libarchive -- directory traversal in bsdcpio mailing-list
- DSA-3180 vendor-advisory
- USN-2549-1 vendor-advisory
- https://groups.google.com/forum/#%21msg/libarchive-discuss/dN9y1VvE1Qk/Z9uerigjQn0J
- GLSA-201701-03 vendor-advisory
- MDVSA-2015:157 vendor-advisory
- [oss-security] 20150108 Directory traversals in cpio and friends? mailing-list