A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Details
- CVSS 4.0 Base Score: 4.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-libarchive | Aug 8, 2025 | Feb 24, 2025 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Feb 24, 2025 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Feb 24, 2025 | |
| Suse | — | suse-upgrade-bsdtarsuse-upgrade-libarchive-develsuse-upgrade-libarchive13suse-upgrade-libarchive13-32bit | Mar 24, 2025 | Feb 24, 2025 |
| Ubuntu | ubuntu-upgrade-libarchive-toolsubuntu-upgrade-libarchive13t64 | Apr 24, 2025 | Feb 24, 2025 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jul 2, 2025 | Feb 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub