p PatchFirst

PatchFirst · Latest vulnerabilities

libarchive vulnerabilities · Page 2

Vulnerability published for libarchive in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 24

  1. CVE-2022-36227

    Critical · CVSS 9.8EPSS 2.46%Fix available

    CVE-2022-36227

    In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

    libarchiveOperating systems
    • Update to 3.6.0-1ubuntu1.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2022-28066

    Medium · CVSS 5.5Fix available

    UBUNTU-CVE-2022-28066

    Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-26280. Reason: This candidate is a duplicate of CVE-2022-26280. Notes: All CVE users should reference CVE-2022-26280 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

    libarchiveOperating systems
    • Update to 3.6.0-1ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →