Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

The remote NewStart CGSL host, running version MAIN 7.02, has libarchive packages installed that are affected by multiple vulnerabilities:

  - list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which     can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a     verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
    (CVE-2025-25724)

  - A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects     the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is     possible to launch the attack on the local host. The exploit has been disclosed to the public and may be     used. The vendor was contacted early about this disclosure but did not respond in any way. (CVE-2025-1632)

  - Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside     archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race     condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to     implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-     privileged local user can delete and rename files inside those directories. (CVE-2023-30571)

  - Libarchive Remote Code Execution Vulnerability (CVE-2024-26256)

  - execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds     access via a crafted archive file because src can move beyond dst. (CVE-2024-48957)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside     archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race     condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to     implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-     privileged local user can delete and rename files inside those directories. (CVE-2023-30571)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
242814	NewStart CGSL MAIN 7.02 : libarchive Multiple Vulnerabilities (NS-SA-2025-0118)	Nessus	NewStart CGSL Local Security Checks	medium
227386	Linux Distros Unpatched Vulnerability : CVE-2023-30571	Nessus	Misc.	medium

Detections

Analytics

CVE-2023-30571

medium

Tenable Plugins

medium

medium