CVE-2025-5917
Libarchive: off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c
Published:
6/9/2025
Last updated:
6/30/2026
Reserved:
6/9/2025
A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.
CNA assigner:
redhat (53f830b8-0a3f-465b-8143-3b8a9948e749)
Requested by:
n/a
Products affected (10)
| Product |
Vendor |
Version |
|
|
< V4.3.8
|
| Red Hat Enterprise Linux 10 |
Red Hat
|
< V5.6.0
|
| Red Hat Enterprise Linux 6 |
Red Hat
|
< V4.3.8
|
| Red Hat Enterprise Linux 7 |
Red Hat
|
< V4.3.8
|
| Red Hat Enterprise Linux 8 |
Red Hat
|
< V4.3.8
|
| Red Hat Enterprise Linux 9 |
Red Hat
|
< V5.6.0
|
| Red Hat Enterprise Linux 8 |
Red Hat
|
10 Version 1803 for ARM64-based Systems
|
| Red Hat Enterprise Linux 9 |
Red Hat
|
unspecified
|
| Red Hat OpenShift Container Platform 4 |
Red Hat
|
< V4.3.8
|
| Red Hat OpenShift Container Platform 4 |
Red Hat
|
unspecified
|