Critical Security Update for libarchive and bsdtar: Heap Overflow and Integer Overflow Vulnerabilities
Summary
ALSA-2026:69553: Low: libarchive security update. Affects bsdtar versions < 3.7.7-11.el10_2. Fixed in 3.7.7-11.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libarchive is a programming library that facilitates the creation and reading of various streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. It is widely utilized in the bsdtar utility, scripting language bindings like python-libarchive, and numerous popular desktop file managers. The library's functionality is essential for managing archive files, but it has been found to be vulnerable to specific security issues that could potentially compromise system integrity.
Vulnerability Detail
The vulnerabilities in libarchive stem from a heap overflow and a signed integer overflow. The heap overflow occurs during the parsing of a tar archive containing a PAX extended header, which can lead to out-of-bounds read operations, potentially allowing an attacker to execute arbitrary code. The signed integer overflow in the archive_write_zip_header function can also lead to unexpected behavior, which may be exploited to compromise the application. These vulnerabilities can have severe ramifications, including unauthorized access and data corruption.
How To Fix
Minimum fixed version
3.7.7-11.el10_2
This is the first release that contains the fix.
sudo dnf update bsdtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for these vulnerabilities. The best course of action is to apply the security updates as soon as they are available.
Conclusion
The vulnerabilities identified in libarchive and bsdtar highlight critical security risks that could compromise system integrity. It is imperative for users to update their packages to the latest patched versions to safeguard against potential exploits. Regular monitoring and timely updates are essential for maintaining a secure software environment.
See every vulnerability recorded for bsdtar →
FAQ
Libarchive is a programming library that allows for the creation and reading of various archive formats, making it essential for file management in many applications.
The heap overflow vulnerability can lead to out-of-bounds read operations, which may allow attackers to execute arbitrary code on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While no specific workarounds are available, it is crucial to prioritize updating the affected packages as soon as possible to mitigate the risks.
Yes, in addition to the heap overflow, there is a signed integer overflow vulnerability that also poses a security risk.
Related vulnerabilities
Recent vulnerabilities recorded for bsdtar.
