According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.(CVE-2025-5917)

    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.(CVE-2025-5916)

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.(CVE-2025-5918)

    list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which     can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a     verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom     locale.(CVE-2025-25724)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0465 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-5918:
    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.

    CVE-2025-5917:
    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.

    CVE-2025-5916:
    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.

    CVE-2025-5915:
    A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-     read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window.
    This means the library may attempt to read beyond the allocated memory buffer, which can result in     unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information     from adjacent memory regions.

    CVE-2025-5914:
    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which     can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a     verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom     locale.(CVE-2025-25724)

    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.(CVE-2025-5916)

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.(CVE-2025-5918)

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.(CVE-2025-5917)

    An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file     tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and     lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

    A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically     within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the     decompression routine may enter a state where internal logic prevents forward progress. This condition     results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum     validation and appears structurally valid, affected applications cannot detect the issue before     processing. This can allow attackers to cause persistent denial-of-service conditions in services that     automatically process archives.(CVE-2026-4111)

    A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression     logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A     remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect     memory allocation and potential application crashes, resulting in a denial-of-service (DoS)     condition.(CVE-2026-4426)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1766232351 advisory.

  - A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive. This bug affects libarchive versions prior to     3.8.0. (CVE-2025-5916)

  - A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0. (CVE-2025-5917)

  - A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition. (CVE-2025-5918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2932 advisory.

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation. (CVE-2025-5917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.(CVE-2025-5917)

    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.(CVE-2025-5916)

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.(CVE-2025-5918)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libarchive package has been released.

ID	Name	Product	Family	Published	Updated	Severity
297298	EulerOS Virtualization 2.10.1 : libarchive (EulerOS-SA-2026-1125)	Nessus	Huawei Local Security Checks	1/31/2026	4/30/2026	high
276048	TencentOS Server 4: libarchive (TSSA-2025:0465)	Nessus	Tencent Local Security Checks	11/20/2025	4/30/2026	high
347143	EulerOS Virtualization 2.11.0 : libarchive (EulerOS-SA-2026-3513)	Nessus	Huawei Local Security Checks	9/18/2026	9/21/2026	high
352850	AlmaLinux 9.6 [TuxCare] Security Update: bsdcat / bsdcpio / bsdtar / libarchive / libarchive-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1766232351)	Nessus	Alma Linux Local Security Checks	9/30/2026	10/1/2026	high
243246	Amazon Linux 2 : libarchive (ALAS-2025-2932)	Nessus	Amazon Linux Local Security Checks	7/31/2025	4/30/2026	low
261867	EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2025-2073)	Nessus	Huawei Local Security Checks	9/10/2025	4/30/2026	medium
261897	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2025-2044)	Nessus	Huawei Local Security Checks	9/10/2025	4/30/2026	medium
275317	Photon OS 5.0: Libarchive PHSA-2025-5.0-0672	Nessus	PhotonOS Local Security Checks	11/13/2025	10/14/2026	medium

Detections

Analytics

Plugins Search

high

high

high

high

low

medium

medium

medium