Description
libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.3.3-2 | — |
| Debian 13 | libarchive | 3.3.3-2 | — |
| Debian 12 | libarchive | 3.3.3-2 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | libarchive | 3.3.2-3.8.4 | SUSE-SU-2019:0831-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bsdtar | 3.5.1-1.5 | openSUSE-SU-2024:10925-1 |
| openSUSE Leap 15.0 | libarchive | 3.3.2-lp150.7.1 | openSUSE-SU-2019:1196-1 |
Advisories 4
- openSUSE-SU-2024:10925-1 bsdtar-3.5.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1196-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0831-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-2070 libarchive: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Oct 27, 2024
References
- https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175
- https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909
- https://github.com/libarchive/libarchive/pull/1105
- 106324 vdb-entry
- FEDORA-2019-0233ec0ff3 vendor-advisory
- FEDORA-2019-fbe83d0e32 vendor-advisory
- FEDORA-2019-c595a93536 vendor-advisory
- openSUSE-SU-2019:1196 vendor-advisory