libarchive up to 3.7.7 TAR Archive archive_read_support_format_tar.c header_gnu_longlink buffer over-read

Summaryinfo

A vulnerability classified as problematic has been found in libarchive up to 3.7.7. The impacted element is the function header_gnu_longlink of the file archive_read_support_format_tar.c of the component TAR Archive Handler. The manipulation leads to buffer over-read. This vulnerability is listed as CVE-2024-57970. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in libarchive up to 3.7.7. It has been rated as problematic. This issue affects the function header_gnu_longlink of the file archive_read_support_format_tar.c of the component TAR Archive Handler. The manipulation with an unknown input leads to a buffer over-read vulnerability. Using CWE to declare the problem leads to CWE-126. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. Impacted is availability. The summary by CVE is:

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-57970 since 02/16/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 237836 (RHEL 10 : libarchive (RHSA-2025:7510)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (237836) and EUVD (EUVD-2024-53870). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• File Compression Software

Name

• libarchive

Version

• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7

License

• open-source

Website

• Product: https://github.com/libarchive/libarchive/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion