Empty-Name File Vulnerability in Libarchive Could Lead to Name Out-of-Bounds Access
CVE-2024-37407

9.1CRITICAL

Key Information:

Vendor

Libarchive

Status
Libarchive
Vendor
CVE Published:
8 June 2024

What is CVE-2024-37407?

Libarchive, a widely used library for reading and writing archive files, contains a vulnerability that allows for name out-of-bounds access under specific conditions. When processing ZIP archives that include empty-name files while the mac-ext option is enabled, the slurp_central_directory functionality in archive_read_support_format_zip.c fails to properly validate input, which can lead to potentially detrimental consequences. Users of Libarchive are strongly advised to upgrade to version 3.7.4 or later to mitigate this risk.

References

https://github.com/libarchive/libarchive/pull/2145
https://github.com/libarchive/libarchive/commit/b6a979481...
https://github.com/libarchive/libarchive/releases/tag/v3.7.4

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.