Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure libarchive before 3.7.7‑3 can read extra memory
published 1 year ago
Summary
The libarchive component used in Azure versions earlier than 3.7.7‑3 may read past the end of its data buffer. This can cause the program to crash or expose nearby information, potentially interrupting service. Update libarchive to version 3.7.7‑3 or later to stop the risk.
What to do
- Update azure libarchive to version 3.7.7-3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | libarchive |
< 3.7.7-3 Fix: upgrade to 3.7.7-3
|
Original advisory text
CVE-2025-5915 affecting package libarchive for versions less than 3.7.7-3
A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.
References
Timeline
Published9 Jun 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-63786 · OSV
Track software like this
Free during beta