Описание
A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw was found in the bsdunzip utility of libarchive. In affected versions, a specially crafted file may trigger a null pointer dereference. This issue can lead to an application crash or other unexpected behavior. This bug does not compromise the integrity or availability of the base system.
Отчет
This vulnerability is rated as having a Low impact because successful exploitation only results in a localized application crash during archive inspection, causing minimal denial of service without compromising system confidentiality or integrity. On Red Hat Enterprise Linux and container environments, bsdunzip operates as an ephemeral command-line tool rather than a persistent network service, restricting the blast radius solely to the active process. Triggering this flaw requires a user or script to deliberately process a specially crafted archive file.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libarchive | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libarchive | Fix deferred | ||
| Red Hat Enterprise Linux 7 | libarchive | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libarchive | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libarchive | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ai-gateway-operator-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-core-bff-rhel9 | Under investigation | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-operator-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-rhel9 | Under investigation | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-data-science-pipelines-operator-controller-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
3.3 Low
CVSS3
Связанные уязвимости
A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in libarchive up to 3.7.7. It has been class ...
A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS
3.3 Low
CVSS3