Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

bsdtar and related tools may execute unwanted code

published 27 days ago

Summary

The bsdtar program and its related utilities (bsdcat, bsdcpio, bsdunzip) on Red Hat systems can be manipulated to run code that an attacker provides. This could let an attacker gain control or disrupt services. Update the packages to the latest versions provided by Red Hat to protect your systems.

What to do

Update redhat bsdcat-debuginfo to version 0:3.7.7-11.el10_2.
Update redhat bsdcpio-debuginfo to version 0:3.7.7-11.el10_2.
Update redhat bsdtar to version 0:3.7.7-11.el10_2.
Update redhat bsdtar-debuginfo to version 0:3.7.7-11.el10_2.
Update redhat bsdunzip-debuginfo to version 0:3.7.7-11.el10_2.
Update redhat libarchive-debuginfo to version 0:3.7.7-11.el10_2.
Update redhat libarchive-debugsource to version 0:3.7.7-11.el10_2.
Update redhat libarchive-devel to version 0:3.7.7-11.el10_2.
Update redhat libarchive to version 0:3.7.7-11.el10_2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:10.2	redhat	bsdcat-debuginfo	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	bsdcpio-debuginfo	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	bsdtar	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	bsdtar-debuginfo	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	bsdunzip-debuginfo	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	libarchive-debuginfo	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	libarchive-debugsource	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	libarchive-devel	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
Red Hat:enterprise_linux:10.2	redhat	libarchive	< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2

Original advisory text

Red Hat Security Advisory: libarchive security update

References

https://access.redhat.com/errata/RHSA-2026:69553 Vendor Advisory
https://access.redhat.com/security/updates/classification/#low Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2497970 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2505492 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69553.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-15028 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-15028 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-15028 Vendor Advisory
https://github.com/libarchive/libarchive/issues/3251 Third Party Advisory
https://github.com/libarchive/libarchive/pull/3253 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-16517 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-16517 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-16517 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

3.9 Low

Timeline

Published22 Sep 2026

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2026:69553 · OSV

Track software like this

Free during beta