CVE-2024-57970

Description

libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.

References

https://github.com/libarchive/libarchive/pull/2422

https://github.com/libarchive/libarchive/issues/2415

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-53870

Details

Source: Mitre, NVD

Named Vulnerability: GHSA-2q66-6w43-8rm9

Risk Information

CVSS v2

CVSS v3

EPSS