CVE-2025-1632
CVE-2025-1632 · libarchive bsdunzip.c list null pointer dereference
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS 4.8 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libarchive
- Versions
- 3.7.0: Affected
- 3.7.1: Affected
- 3.7.2: Affected
- 3.7.3: Affected
- 3.7.4: Affected
- 3.7.5: Affected
- 3.7.6: Affected
- 3.7.7: Affected
No fix published
libarchive Debian:12
- Versions
- 3.6.2-1
- 3.6.2-1+deb12u1
- 3.6.2-1+deb12u2
- 3.6.2-1+deb12u3
- 3.6.2-1+deb12u4
- 3.6.2-1+deb12u5
- 3.7.2-1
- 3.7.2-1.1
- 3.7.2-1.1~exp1
- 3.7.2-2
- 3.7.2-2.1
- 3.7.4-1
- 3.7.4-1.1
- 3.7.4-2
- 3.7.4-3
- 3.7.4-4
- 3.8.4-1
- 3.8.5-1
- 3.8.6-1
- 3.8.7-1
- 3.8.8-1
- 3.8.8-2
- 3.8.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libarchive Debian:13
- Affected ranges
- ECOSYSTEM: < 3.7.4-2
Update to 3.7.4-2
libarchive Debian:14
- Affected ranges
- ECOSYSTEM: < 3.7.4-2
Update to 3.7.4-2
libarchive Ubuntu:24.04:LTS
- Versions
- 3.6.2-1ubuntu1
- 3.7.2-1ubuntu1
- 3.7.2-1ubuntu2
- 3.7.2-1.1ubuntu2
- 3.7.2-2
- 3.7.2-2ubuntu0.1
- 3.7.2-2ubuntu0.2
- 3.7.2-2ubuntu0.3
- Affected ranges
- ECOSYSTEM: < 3.7.2-2ubuntu0.4
Update to 3.7.2-2ubuntu0.4