Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.
CVSS Details
- CVSS 3.1 Base Score: 6.2
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libarchive | Aug 30, 2017 | Mar 15, 2015 |
| Debian | — | Upgrade libarchive | Jul 30, 2024 | Mar 15, 2015 |
| Freebsd | — | Upgrade libarchiveUpgrade FreeBSD | Dec 10, 2025 | Jan 18, 2016 |
| Gentoo Linux | — | Upgrade app-arch/libarchive. | Oct 30, 2017 | Mar 15, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libarchive | Dec 4, 2019 | Mar 15, 2015 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libarchive | Dec 18, 2019 | Mar 15, 2015 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libarchive | Nov 19, 2019 | Mar 15, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 16, 2015 |
| Suse | — | Upgrade bsdtarUpgrade libarchive2Upgrade libarchive13Upgrade libarchive-devel | Dec 18, 2015 | Mar 15, 2015 |
| Ubuntu | — | Upgrade bsdcpioUpgrade libarchive12Upgrade libarchive13 | Nov 8, 2024 | Mar 15, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub