Heap-Based Buffer Over-Read in Libarchive's TAR Archive Handling

CVE-2024-57970

What is CVE-2024-57970?

A vulnerability exists in Libarchive versions up to 3.7.7 that leads to a heap-based buffer over-read when processing TAR archives. This issue arises from improper handling of truncation during the reading of a GNU long linkname. The flaw can be exploited in scenarios where malformed TAR archives are processed, potentially allowing attackers to access sensitive information or disrupt the application.

References