Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.

The remote NewStart CGSL host, running version MAIN 7.02, has libarchive packages installed that are affected by multiple vulnerabilities:

  - list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which     can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a     verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
    (CVE-2025-25724)

  - A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects     the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is     possible to launch the attack on the local host. The exploit has been disclosed to the public and may be     used. The vendor was contacted early about this disclosure but did not respond in any way. (CVE-2025-1632)

  - Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside     archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race     condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to     implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-     privileged local user can delete and rename files inside those directories. (CVE-2023-30571)

  - Libarchive Remote Code Execution Vulnerability (CVE-2024-26256)

  - execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds     access via a crafted archive file because src can move beyond dst. (CVE-2024-48957)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0056 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2022-36227:
    In libarchive before 3.6.2, the software does not check for an error after calling calloc function that     can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
    NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: In     rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it,     then writing or reading memory is possible, which may lead to code execution.

    CVE-2023-30571:
    Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside     archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race     condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to     implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-     privileged local user can delete and rename files inside those directories.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside     archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race     condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to     implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-     privileged local user can delete and rename files inside those directories. (CVE-2023-30571)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
242814	NewStart CGSL MAIN 7.02 : libarchive Multiple Vulnerabilities (NS-SA-2025-0118)	Nessus	NewStart CGSL Local Security Checks	Local	medium
239546	TencentOS Server 4: libarchive (TSSA-2025:0056)	Nessus	Tencent Local Security Checks	Local	critical
227386	Linux Distros Unpatched Vulnerability : CVE-2023-30571	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2023-30571

medium

Tenable Plugins

medium

critical

medium