CPE Details
libarchive 3.4.2
3.4.2
2020-02-24
16h00 +00:00
16h00 +00:00
2020-02-24
16h00 +00:00
16h00 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:libarchive:libarchive:3.4.2:*:*:*:*:*:*:*
Informations
Vendor
libarchiveProduct
libarchiveVersion
3.4.2Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
22h00 +00:00 |
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c. | 9.1 |
Critical |
|
17h00 +00:00 |
Libarchive Remote Code Execution Vulnerability | 7.8 |
High |
|
22h00 +00:00 |
Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories. | 5.3 |
Medium |
|
23h00 +00:00 |
In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution." | 9.8 |
Critical |
|
22h00 +00:00 |
An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges. | 7.8 |
High |
|
22h00 +00:00 |
An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system. | 7.8 |
High |
|
04h49 +00:00 |
libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). | 6.5 |
Medium |
2025©
tesweb SA
