CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-37407
https://notcve.org/view.php?id=CVE-2024-37407
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c. Libarchive anterior a 3.7.4 permite el acceso a nombres fuera de los límites cuando un archivo ZIP tiene un archivo con nombre vacío y mac-ext está habilitado. Esto ocurre en slurp_central_directory en archive_read_support_format_zip.c. • https://github.com/libarchive/libarchive/commit/b6a979481b7d77c12fa17bbed94576b63bbcb0c0 https://github.com/libarchive/libarchive/pull/2145 https://github.com/libarchive/libarchive/releases/tag/v3.7.4 • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30571
https://notcve.org/view.php?id=CVE-2023-30571
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories. Libarchive hasta la versión 3.6.2 puede hacer que los directorios tengan permisos de escritura global. La llamada "umask()" dentro del archivo "archive_write_disk_posix.c" cambia la máscara de usuario de todo el proceso durante un periodo de tiempo muy corto; una condición de carrera con otro hilo puede llevar a un ajuste permanente de la máscara de usuario a 0. • https://github.com/libarchive/libarchive/issues/1876 https://groups.google.com/g/libarchive-announce • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2022-36227 – libarchive: NULL pointer dereference in archive_write.c
https://notcve.org/view.php?id=CVE-2022-36227
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution." En libarchive anterior a 3.6.2, el software no busca un error después de llamar a la función calloc que puede regresar con un puntero NULL si la función falla, lo que conduce a una desreferencia del puntero NULL resultante. NOTA: el descubridor cita este comentario CWE-476, pero terceros cuestionan el impacto de la ejecución del código: "En raras circunstancias, cuando NULL es equivalente a la dirección de memoria 0x0 y el código privilegiado puede acceder a ella, entonces es posible escribir o leer la memoria, lo cual puede llevar a la ejecución del código." A flaw was found in libarchive. • https://bugs.gentoo.org/882521 https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215 https://github.com/libarchive/libarchive/issues/1754 https://lists.debian.org/debian-lts-announce/2023/01/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS https://security.gentoo.org/glsa/202309-14 https://access.redhat.com/security/cve/CVE-2022-36227 https://bugzilla.redhat.com/show_bug.cgi&# • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2022-26280 – libarchive: an out-of-bounds read via the component zipx_lzma_alone_init
https://notcve.org/view.php?id=CVE-2022-26280
Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init. Se ha detectado que Libarchive versión v3.6.0, contiene una lectura fuera de límites por medio del componente zipx_lzma_alone_init An out-of-bounds read flaw was found in libarchive. This flaw allows an attacker who can supply a specially crafted zip file to libarchive to cause an out-of-bounds read in programs linked with libarchive, using the LZMA zip functionality. The consequences depend on the specific program linked with libarchive. Still, they would most likely result in an application crash or information disclosure that could be used in conjunction with another exploit. • https://github.com/libarchive/libarchive/issues/1672 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBYGJICQ7FKDZ2IIOAH423IHWQ6MNONQ https://security.gentoo.org/glsa/202208-26 https://access.redhat.com/security/cve/CVE-2022-26280 https://bugzilla.redhat.com/show_bug.cgi?id=2071931 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 22EXPL: 0CVE-2021-31566 – libarchive: symbolic links incorrectly followed when changing modes, times, ACL and flags of a file while extracting an archive
https://notcve.org/view.php?id=CVE-2021-31566
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system. Un fallo de resolución de enlaces inapropiado puede ocurrir mientras es extraído un archivo que conlleva a un cambio de modos, tiempos, listas de control de acceso y flags de un archivo fuera del archivo. Un atacante puede proporcionar un archivo malicioso a un usuario víctima, que desencadenaría este fallo cuando intente extraer el archivo. • https://access.redhat.com/security/cve/CVE-2021-31566 https://bugzilla.redhat.com/show_bug.cgi?id=2024237 https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043 https://github.com/libarchive/libarchive/issues/1566 https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •