The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libarchive | Dec 28, 2018 | Apr 3, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 11, 2025 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libarchive | Dec 4, 2019 | Apr 3, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libarchive | Dec 18, 2019 | Apr 3, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libarchive | Nov 19, 2019 | Apr 3, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 12, 2016 |
| Suse | — | Upgrade libarchive-develUpgrade libarchive13 | Nov 8, 2018 | Apr 3, 2017 |
| Ubuntu | — | Upgrade libarchive13 | Aug 15, 2018 | Apr 3, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub