Critical Vulnerabilities in libarchive Package: Potential for Code Execution and Denial of Service
Summary
USN-7601-1: libarchive vulnerabilities. Affects libarchive versions < 3.6.0-1ubuntu1.5. Fixed in 3.6.0-1ubuntu1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely used library for reading and writing various archive formats, including ZIP, TAR, and RAR. It provides developers with a robust API for handling compressed files and is integral to many applications on Ubuntu systems. However, recent vulnerabilities have been discovered that compromise its security, particularly in handling certain archive types, making it susceptible to attacks that could lead to arbitrary code execution or denial of service.
Vulnerability Detail
The vulnerabilities in libarchive stem from improper handling of specific RAR and WARC archive files. Attackers can exploit these flaws to execute arbitrary code, read sensitive data, or cause the library to crash, resulting in denial of service. The vulnerabilities are identified as CVE-2025-5914, CVE-2025-5915, CVE-2025-5916, and CVE-2025-5917, each highlighting different aspects of the library's failure to validate input correctly.
How To Fix
Minimum fixed version
3.6.0-1ubuntu1.5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted RAR or WARC archive files until the package is updated. Implement strict validation checks on file inputs to mitigate the risk of exploitation.
Conclusion
The vulnerabilities in the libarchive package pose significant risks, including potential code execution and denial of service. It is crucial for users to update their packages to the latest versions to mitigate these risks. Regular monitoring and validation of archive files can further enhance security.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a library that provides a flexible interface for reading and writing various archive formats, such as ZIP, TAR, and RAR.
The vulnerabilities could lead to arbitrary code execution, exposure of sensitive data, or denial of service, impacting the stability and security of applications using the library.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, refrain from processing untrusted archive files and implement input validation to reduce the risk of exploitation.
Detailed information about the vulnerabilities can be found in the Ubuntu Security Notices, specifically USN-7601-1.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
