Description
libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive | 3.3.3-2 | — |
| Debian 13 | libarchive | 3.3.3-2 | — |
| Debian 12 | libarchive | 3.3.3-2 | — |
| Debian 9 | libarchive | 3.2.2-2+deb9u1 | DSA-4360-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libarchive | 3.2.2-3.1ubuntu0.2 | USN-3859-1 |
| Ubuntu 16.04 LTS | libarchive | 3.1.2-11ubuntu0.16.04.5 | USN-3859-1 |
| Ubuntu 14.04 LTS | libarchive | 3.1.2-7ubuntu2.7 | USN-3859-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | libarchive | 3.3.2-3.8.4 | SUSE-SU-2019:0831-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bsdtar | 3.5.1-1.5 | openSUSE-SU-2024:10925-1 |
| openSUSE Leap 15.0 | libarchive | 3.3.2-lp150.7.1 | openSUSE-SU-2019:1196-1 |
Advisories 6
- USN-3859-1 libarchive vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4360-1 libarchive - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10925-1 bsdtar-3.5.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1196-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0831-1 Security update for libarchive SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-2070 libarchive: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Oct 27, 2024
References
- USN-3859-1 vendor-advisory
- https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909
- DSA-4360 vendor-advisory
- https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680
- https://github.com/libarchive/libarchive/pull/1105
- 106324 vdb-entry
- FEDORA-2019-0233ec0ff3 vendor-advisory
- FEDORA-2019-fbe83d0e32 vendor-advisory
- FEDORA-2019-c595a93536 vendor-advisory
- openSUSE-SU-2019:1196 vendor-advisory