DescriptionMultiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs669197

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libarchive (PTS)buster3.3.3-4+deb10u1fixed
buster (security)3.3.3-4+deb10u3fixed
sid, trixie3.7.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libarchivesourcesqueeze(not affected)


[squeeze] - libarchive <not-affected> (vulnerable code not present in 2.x series)
Might be fixed earlier than 3.0.4-2, but was tested against the Wheezy version

Search for package or bug name: Reporting problems