LI
Product
libarchive
77
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 31Medium 41Low 1
Watch
Add libarchive to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5745 | 5.5 | Apr 7 | Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive Affected: All versions, or not specified |
| CVE-2025-60753 | 5.5 | Nov 5 | An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules Affected: through 3.8.1 |
| CVE-2025-1632 | 5.5 | Feb 24 | A vulnerability was found in libarchive up to 3.7.7 Affected: through 3.7.7 |
| CVE-2019-19221 | 5.5 | Nov 21 | In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call Affected: 3.4.0 |
| CVE-2019-11463 | 5.5 | Apr 23 | A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted… Affected: before 3.4.0 |
| CVE-2016-10350 | 5.5 | May 1 | The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer… Affected: 3.2.2 |
| CVE-2016-10349 | 5.5 | May 1 | The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a… Affected: 3.2.2 |
| CVE-2016-10209 | 5.5 | Apr 3 | The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application… Affected: 3.2.2 |
| CVE-2016-8688 | 5.5 | Feb 15 | The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a… Affected: 3.2.1 |
| CVE-2016-7166 | 5.5 | Sep 21 | libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application… Affected: through 3.1.901a |
| CVE-2015-8934 | 5.5 | Sep 20 | The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap… Affected: through 3.1.901a |
| CVE-2015-8933 | 5.5 | Sep 20 | Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service… Affected: through 3.1.901a |
| CVE-2015-8932 | 5.5 | Sep 20 | The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted… Affected: through 3.1.901a |
| CVE-2015-8929 | 5.5 | Sep 20 | Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file Affected: through 3.1.901a |
| CVE-2015-8928 | 5.5 | Sep 20 | The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a… Affected: through 3.1.901a |
| CVE-2015-8927 | 5.5 | Sep 20 | The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read… Affected: through 3.1.901a |
| CVE-2015-8926 | 5.5 | Sep 20 | The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a… Affected: through 3.1.901a |
| CVE-2015-8925 | 5.5 | Sep 20 | The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree… Affected: through 3.1.901a |
| CVE-2015-8924 | 5.5 | Sep 20 | The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service… Affected: through 3.1.901a |
| CVE-2015-8922 | 5.5 | Sep 20 | The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: through 3.1.901a |
| CVE-2015-8920 | 5.5 | Sep 20 | The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a… Affected: through 3.1.901a |
| CVE-2015-8915 | 5.5 | Sep 20 | bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file Affected: through 3.1.901a |
| CVE-2023-30571 | 5.3 | May 29 | Libarchive through 3.6.2 can cause directories to have world-writable permissions Affected: through 3.6.2 |
| CVE-2025-5917 | 5.0 | Jun 9 | A vulnerability has been identified in the libarchive library Affected: before 3.8.0 |
| CVE-2025-64031 | 2.5 | Sep 14 | libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in… Affected: 3.8.0 before 3.8.2 |
| CVE-2015-2304 | – | Mar 15 | Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive Affected: through 3.1.2 |
| CVE-2013-0211 | – | Sep 30 | Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows… Affected: through 3.1.2 |