Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.9
rocky/libarchive can be tricked into reading data
published 26 days ago
Summary
The libarchive library, which lets programs create and open archive files such as tar and zip, is included in Rocky Linux. A coding mistake can cause it to read beyond its memory or misuse size numbers when handling certain special archive data, which could let an attacker cause a crash or possibly run unwanted code. Install the latest libarchive update from Rocky Linux as soon as possible and restart any programs that use it.
What to do
- Update rocky libarchive to version 0:3.7.7-11.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | libarchive |
< 0:3.7.7-11.el10_2 Fix: upgrade to 0:3.7.7-11.el10_2
|
Original advisory text
Low: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.
Security Fix(es):
* libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028)
* libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libarchive: heap overflow OOB read while parsing a tar archive contains a PAX extended header (CVE-2026-15028)
* libarchive: libarchive: Signed Integer Overflow in archive_write_zip_header (CVE-2026-16517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:69553 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2497970 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2505492 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:69553 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published23 Sep 2026
Updated30 Sep 2026
First seen30 Sep 2026
Sources
RLSA-2026:69553 · OSV
Track software like this
Free during beta