Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Libarchive | — | Upgrade macOS to the latest version | Jan 24, 2017 | Jan 24, 2017 |
| Debian | — | Upgrade libarchive | Mar 31, 2017 | Oct 17, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 23, 2017 |
| Gentoo Linux | — | Upgrade app-arch/libarchive. | Oct 30, 2017 | Feb 15, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libarchive | Dec 4, 2019 | Feb 15, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libarchive | Sep 25, 2019 | Feb 15, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libarchive | Nov 19, 2019 | Feb 15, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 15, 2016 |
| Suse | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive13 | Nov 25, 2016 | Nov 25, 2016 |
| Ubuntu | — | Upgrade libarchive12Upgrade libarchive13 | Mar 10, 2017 | Nov 25, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub