In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libarchive-develUpgrade libarchiveUpgrade bsdtar | May 15, 2023 | Nov 22, 2022 |
| Alpine Linux | — | Upgrade libarchive | Mar 26, 2024 | Nov 22, 2022 |
| Amazon Linux Ami 2 | — | Upgrade bsdtarUpgrade bsdcpioUpgrade libarchive-debuginfoUpgrade libarchiveUpgrade libarchive-devel | Oct 6, 2023 | Nov 22, 2022 |
| Amazon_linux_2023 | — | Upgrade libarchive-develUpgrade bsdcat-debuginfoUpgrade libarchive-debugsourceUpgrade libarchive-debuginfoUpgrade bsdtar-debuginfoUpgrade libarchiveUpgrade bsdcpio-debuginfoUpgrade bsdcpioUpgrade bsdcatUpgrade bsdtar | Feb 17, 2025 | Jul 11, 2022 |
| Centos_linux | — | Upgrade bsdcat-debuginfoUpgrade libarchive-debugsourceUpgrade libarchive-debuginfoUpgrade bsdtar-debuginfoUpgrade libarchiveUpgrade bsdtarUpgrade bsdcpio-debuginfo | May 15, 2023 | Nov 22, 2022 |
| Debian | — | Upgrade libarchive | Feb 1, 2023 | Nov 22, 2022 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 6, 2024 |
| Gentoo Linux | — | Upgrade app-arch/libarchive. | Oct 2, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libarchive | Feb 13, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libarchive | Mar 8, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libarchive | Jun 9, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libarchiveUpgrade libarchive-develUpgrade bsdtar | Feb 9, 2023 | Nov 22, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libarchive | Mar 9, 2023 | Nov 22, 2022 |
| Oracle_linux | — | Upgrade libarchive-develUpgrade libarchiveUpgrade bsdtar | May 17, 2023 | Jul 11, 2022 |
| Redhat_linux | — | Upgrade bsdtar-debuginfoUpgrade libarchiveUpgrade libarchive-debuginfoNo solution existsUpgrade bsdtarUpgrade bsdcat-debuginfoUpgrade libarchive-develUpgrade bsdcpio-debuginfoUpgrade libarchive-debugsource | May 15, 2023 | Nov 22, 2022 |
| Rocky_linux | — | Upgrade bsdtarUpgrade libarchiveUpgrade bsdtar-debuginfoUpgrade libarchive-debuginfoUpgrade libarchive-debugsourceUpgrade libarchive-devel | Mar 23, 2026 | Mar 20, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Universal Forwarder to version 8.2.12Upgrade Splunk Universal Forwarder to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Universal Forwarder to version 8.2.11Upgrade Splunk Universal Forwarder to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Universal Forwarder to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Universal Forwarder to version 9.0.6 | Sep 30, 2025 | Nov 22, 2022 |
| Suse | — | Upgrade libarchive-develUpgrade libarchive13-32bitUpgrade bsdtarUpgrade libarchive13 | Nov 24, 2022 | Nov 22, 2022 |
| Ubuntu | — | Upgrade libarchive13 (Ubuntu Pro)Upgrade libarchive13t64Upgrade libarchive13 | Oct 17, 2024 | Nov 22, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 22, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub