According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.(CVE-2025-5916)

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.(CVE-2025-5918)

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.(CVE-2025-5917)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02718-2 advisory.

    - CVE-2025-5914: Fixed double free due to an integer overflow in the archive_read_format_rar_seek_data()     function (bsc#1244272)
    - CVE-2025-5915: Fixed heap buffer over read in copy_from_lzss_window() at     archive_read_support_format_rar.c (bsc#1244273)
    - CVE-2025-5916: Fixed integer overflow while reading warc files at archive_read_support_format_warc.c     (bsc#1244270)
    - CVE-2025-5917: Fixed off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c     (bsc#1244336)
    - CVE-2025-5918: Fixed reading past EOF may be triggered for piped file streams (bsc#1244279)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.(CVE-2025-5917)

    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.(CVE-2025-5916)

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.(CVE-2025-5918)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.(CVE-2025-5918)

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.(CVE-2025-5917)

    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.(CVE-2025-5916)

    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition. (CVE-2025-5918)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4368 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4368-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     November 11, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libarchive     Version        : 3.4.3-2+deb11u3     CVE ID         : CVE-2025-5914 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918     Debian Bug     : 1107621 1107623 1107624 1107626

    Multiple vulnerabilties were fixed in libarchive a multi-format archive     and compression library.

    CVE-2025-5914

        A vulnerability has been identified in the libarchive library,         specifically within the archive_read_format_rar_seek_data() function.
        This flaw involves an integer overflow that can ultimately lead to         a double-free condition. Exploiting a double-free vulnerability can         result in memory corruption, enabling an attacker to execute         arbitrary code or cause a denial-of-service condition.

    CVE-2025-5916

        This flaw involves an integer overflow that can be triggered         when processing a Web Archive (WARC) file that claims to have more         than INT64_MAX - 4 content bytes. An attacker could craft a malicious         WARC archive to induce this overflow, potentially leading to         unpredictable program behavior, memory corruption, or a         denial-of-service condition within applications that process         such archives using libarchive.

    CVE-2025-5917

        This flaw involves an 'off-by-one' miscalculation when         handling prefixes and suffixes for file names. This can lead to         a 1-byte write overflow. While seemingly small, such an overflow         can corrupt adjacent memory, leading to unpredictable program behavior,         crashes, or in specific circumstances, could be leveraged as         a building block for more sophisticated exploitation.

    CVE-2025-5918

        This flaw can be triggered when file streams are piped into bsdtar,         potentially allowing for reading past the end of the file.
        This out-of-bounds read can lead to unintended consequences,         including unpredictable program behavior, memory corruption,         or a denial-of-service condition.

    For Debian 11 bullseye, these problems have been fixed in version     3.4.3-2+deb11u3.

    We recommend that you upgrade your libarchive packages.

    For the detailed security status of libarchive please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libarchive

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libarchive package has been released.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0465 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-5918:
    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.

    CVE-2025-5917:
    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.

    CVE-2025-5916:
    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.

    CVE-2025-5915:
    A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-     read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window.
    This means the library may attempt to read beyond the allocated memory buffer, which can result in     unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information     from adjacent memory regions.

    CVE-2025-5914:
    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02566-1 advisory.

    - CVE-2025-5914: Fixed double free due to an integer overflow in the archive_read_format_rar_seek_data()     function (bsc#1244272)
    - CVE-2025-5915: Fixed heap buffer over read in copy_from_lzss_window() at     archive_read_support_format_rar.c (bsc#1244273)
    - CVE-2025-5916: Fixed integer overflow while reading warc files at archive_read_support_format_warc.c     (bsc#1244270)
    - CVE-2025-5917: Fixed off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c     (bsc#1244336)
    - CVE-2025-5918: Fixed reading past EOF may be triggered for piped file streams (bsc#1244279)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
249315	EulerOS 2.0 SP11 : libarchive (EulerOS-SA-2025-1932)	Nessus	Huawei Local Security Checks	8/14/2025	8/14/2025	high
253437	SUSE SLES15 Security Update : libarchive (SUSE-SU-2025:02718-2)	Nessus	SuSE Local Security Checks	8/21/2025	8/21/2025	medium
261874	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2025-2013)	Nessus	Huawei Local Security Checks	9/10/2025	9/10/2025	medium
261891	EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2025-2101)	Nessus	Huawei Local Security Checks	9/10/2025	9/10/2025	medium
264852	EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2025-2145)	Nessus	Huawei Local Security Checks	9/16/2025	9/16/2025	medium
244236	Linux Distros Unpatched Vulnerability : CVE-2025-5918	Nessus	Misc.	8/6/2025	11/12/2025	medium
274817	Debian dla-4368 : libarchive-dev - security update	Nessus	Debian Local Security Checks	11/11/2025	11/11/2025	critical
275317	Photon OS 5.0: Libarchive PHSA-2025-5.0-0672	Nessus	PhotonOS Local Security Checks	11/13/2025	11/13/2025	medium
261867	EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2025-2073)	Nessus	Huawei Local Security Checks	9/10/2025	9/10/2025	medium
264867	EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2025-2135)	Nessus	Huawei Local Security Checks	9/16/2025	9/16/2025	medium
276048	TencentOS Server 4: libarchive (TSSA-2025:0465)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	critical
243270	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libarchive (SUSE-SU-2025:02566-1)	Nessus	SuSE Local Security Checks	8/1/2025	8/1/2025	critical
249284	EulerOS 2.0 SP11 : libarchive (EulerOS-SA-2025-1958)	Nessus	Huawei Local Security Checks	8/14/2025	8/14/2025	high
261897	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2025-2044)	Nessus	Huawei Local Security Checks	9/10/2025	9/10/2025	medium

Detections

Analytics

Plugins Search

high

medium

medium

medium

medium

medium

critical

medium

medium

medium

critical

critical

high

medium