CVE-2024-57970
Fixed in a distro release EPSS <1%CVSS 4.0
libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.
Products: libarchive
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | bsdtar | 3.7.7-2.el10_0 |
| AlmaLinux 10 | libarchive | 3.7.7-2.el10_0 |
| AlmaLinux 10 | libarchive-devel | 3.7.7-2.el10_0 |
| Alpine 3.18 | libarchive | 3.7.9-r0 |
| Alpine 3.19 | libarchive | 3.7.9-r0 |
| Alpine 3.20 | libarchive | 3.7.9-r0 |
| Alpine 3.21 | libarchive | 3.7.9-r0 |
| Alpine 3.22 | libarchive | 3.7.9-r0 |
| Alpine 3.23 | libarchive | 3.7.9-r0 |
| Alpine 3.24 | libarchive | 3.7.9-r0 |
| Chainguard | libarchive-dev | 3.7.7-r2 |
| Red Hat Enterprise Linux 10.0 | bsdcat-debuginfo | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | bsdcpio-debuginfo | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | bsdtar | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | bsdtar-debuginfo | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | bsdunzip-debuginfo | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | libarchive | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | libarchive-debuginfo | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | libarchive-debugsource | 0:3.7.7-2.el10_0 |
| Red Hat Enterprise Linux 10.0 | libarchive-devel | 0:3.7.7-2.el10_0 |
| Rocky Linux 10 | libarchive | 0:3.7.7-2.el10_0 |
| Wolfi | libarchive-dev | 3.7.7-r2 |
| openSUSE Tumbleweed | libarchive | 3.7.7-2.1 |