In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libarchive-develUpgrade libarchiveUpgrade bsdtar | May 15, 2023 | Nov 22, 2022 |
| Alpine Linux | — | Upgrade libarchive | Mar 26, 2024 | Nov 22, 2022 |
| Amazon Linux Ami 2 | — | Upgrade bsdtarUpgrade bsdcpioUpgrade libarchiveUpgrade libarchive-develUpgrade libarchive-debuginfo | Oct 6, 2023 | Nov 22, 2022 |
| Amazon_linux_2023 | — | Upgrade bsdcat-debuginfoUpgrade libarchive-debugsourceUpgrade libarchive-develUpgrade bsdtar-debuginfoUpgrade bsdcpio-debuginfoUpgrade bsdcpioUpgrade bsdcatUpgrade libarchiveUpgrade bsdtarUpgrade libarchive-debuginfo | Feb 17, 2025 | Jul 11, 2022 |
| Centos_linux | — | Upgrade bsdcpio-debuginfoUpgrade libarchiveUpgrade bsdtarUpgrade bsdtar-debuginfoUpgrade libarchive-debugsourceUpgrade libarchive-debuginfoUpgrade bsdcat-debuginfo | May 15, 2023 | Nov 22, 2022 |
| Debian | — | Upgrade libarchive | Feb 1, 2023 | Nov 22, 2022 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 6, 2024 |
| Gentoo Linux | — | Upgrade app-arch/libarchive. | Oct 2, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libarchive | Feb 13, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libarchive | Mar 8, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libarchive | Jun 9, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade bsdtarUpgrade libarchiveUpgrade libarchive-devel | Feb 9, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libarchive | Mar 9, 2023 | Nov 22, 2022 |
| Oracle_linux | — | Upgrade libarchiveUpgrade bsdtarUpgrade libarchive-devel | May 17, 2023 | Jul 11, 2022 |
| Redhat_linux | — | Upgrade libarchive-develUpgrade libarchive-debugsourceUpgrade bsdcat-debuginfoUpgrade bsdcpio-debuginfoUpgrade bsdtarNo solution existsUpgrade libarchiveUpgrade libarchive-debuginfoUpgrade bsdtar-debuginfo | May 15, 2023 | Nov 22, 2022 |
| Rocky_linux | — | Upgrade bsdtarUpgrade bsdtar-debuginfoUpgrade libarchiveUpgrade libarchive-develUpgrade libarchive-debugsourceUpgrade libarchive-debuginfo | Mar 23, 2026 | Mar 20, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Universal Forwarder to version 9.0.6Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Universal Forwarder to version 9.1.1Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Universal Forwarder to version 8.2.11Upgrade Splunk Universal Forwarder to version 8.2.12Upgrade Splunk Universal Forwarder to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Universal Forwarder to version 8.1.14 | Sep 30, 2025 | Nov 22, 2022 |
| Suse | — | Upgrade libarchive13-32bitUpgrade libarchive-develUpgrade bsdtarUpgrade libarchive13 | Nov 24, 2022 | Nov 22, 2022 |
| Ubuntu | — | Upgrade libarchive13Upgrade libarchive13 (Ubuntu Pro)Upgrade libarchive13t64 | Oct 17, 2024 | Nov 22, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub