JLSEC-2025-250
NoneCVSS
—
EPSS
—
Published
Nov 25, 2025
CISA due date
—
The record
libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_su...
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.18 | libarchive | 0 | 3.7.9-r0 |
| Alpine:v3.19 | libarchive | 0 | 3.7.9-r0 |
| Alpine:v3.20 | libarchive | 0 | 3.7.9-r0 |
| Alpine:v3.21 | libarchive | 0 | 3.7.9-r0 |
| Alpine:v3.22 | libarchive | 0 | 3.7.9-r0 |
| Debian:11 | libarchive | 0 | No fix |
| Debian:12 | libarchive | 0 | No fix |
| Debian:13 | libarchive | 0 | No fix |
| Julia | LibArchive_jll | 0 | 3.7.9+0 |
Related vulnerabilities
- CVE-2024-57970 libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in… Same vulnerability
- CVE-2024-20696 Windows Libarchive Remote Code Execution Vulnerability Also affects libarchive
- CVE-2024-48958 execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5… Also affects libarchive
- CVE-2024-48957 execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5… Also affects libarchive
- CVE-2017-14502 read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an… Also affects libarchive
- CVE-2016-10209 The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2… Also affects libarchive
- CVE-2016-5418 The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries… Also affects libarchive
- CVE-2015-8921 The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote… Also affects libarchive