libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libarchive | Aug 8, 2025 | Feb 16, 2025 |
| Oracle_linux | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive | Jul 10, 2025 | Feb 16, 2025 |
| Redhat_linux | — | Upgrade libarchive-debuginfoUpgrade libarchive-debugsourceUpgrade libarchive-develUpgrade bsdtar-debuginfoUpgrade bsdcpio-debuginfoNo solution existsUpgrade bsdunzip-debuginfoUpgrade libarchiveUpgrade bsdcat-debuginfoUpgrade bsdtar | Jul 9, 2025 | Feb 16, 2025 |
| Rocky_linux | — | Upgrade bsdtarUpgrade libarchive-develUpgrade libarchive-debugsourceUpgrade libarchive-debuginfoUpgrade libarchiveUpgrade bsdtar-debuginfo | Oct 6, 2025 | Oct 3, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub