Security update for libarchive SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:02566-1 Final 1 1 2025-07-31T07:18:45Z current 2025-07-31T07:18:45Z 2025-07-31T07:18:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libarchive This update for libarchive fixes the following issues: - CVE-2025-5914: Fixed double free due to an integer overflow in the archive_read_format_rar_seek_data() function (bsc#1244272) - CVE-2025-5915: Fixed heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c (bsc#1244273) - CVE-2025-5916: Fixed integer overflow while reading warc files at archive_read_support_format_warc.c (bsc#1244270) - CVE-2025-5917: Fixed off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c (bsc#1244336) - CVE-2025-5918: Fixed reading past EOF may be triggered for piped file streams (bsc#1244279) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/spack:0.23-2025-2566,Container bci/spack:latest-2025-2566,Container containers/pytorch:2-nvidia-2025-2566,Container suse/samba-client:latest-2025-2566,Container suse/samba-server:latest-2025-2566,Container suse/samba-toolbox:latest-2025-2566,SUSE-2025-2566,SUSE-SLE-Module-Basesystem-15-SP6-2025-2566,SUSE-SLE-Module-Basesystem-15-SP7-2025-2566,SUSE-SLE-Module-Development-Tools-15-SP6-2025-2566,SUSE-SLE-Module-Development-Tools-15-SP7-2025-2566,openSUSE-SLE-15.6-2025-2566 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202502566-1/ Link for SUSE-SU-2025:02566-1 https://lists.suse.com/pipermail/sle-updates/2025-July/040969.html E-Mail link for SUSE-SU-2025:02566-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1244270 SUSE Bug 1244270 https://bugzilla.suse.com/1244272 SUSE Bug 1244272 https://bugzilla.suse.com/1244273 SUSE Bug 1244273 https://bugzilla.suse.com/1244279 SUSE Bug 1244279 https://bugzilla.suse.com/1244336 SUSE Bug 1244336 https://www.suse.com/security/cve/CVE-2025-5914/ SUSE CVE CVE-2025-5914 page https://www.suse.com/security/cve/CVE-2025-5915/ SUSE CVE CVE-2025-5915 page https://www.suse.com/security/cve/CVE-2025-5916/ SUSE CVE CVE-2025-5916 page https://www.suse.com/security/cve/CVE-2025-5917/ SUSE CVE CVE-2025-5917 page https://www.suse.com/security/cve/CVE-2025-5918/ SUSE CVE CVE-2025-5918 page Container bci/spack:0.23 Container bci/spack:latest Container containers/pytorch:2-nvidia Container suse/samba-client:latest Container suse/samba-server:latest Container suse/samba-toolbox:latest SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 openSUSE Leap 15.6 libarchive13-3.7.2-150600.3.17.1 bsdtar-3.7.2-150600.3.17.1 libarchive-devel-3.7.2-150600.3.17.1 libarchive13-32bit-3.7.2-150600.3.17.1 libarchive13-64bit-3.7.2-150600.3.17.1 libarchive13-3.7.2-150600.3.17.1 as a component of Container bci/spack:0.23 libarchive13-3.7.2-150600.3.17.1 as a component of Container bci/spack:latest libarchive13-3.7.2-150600.3.17.1 as a component of Container containers/pytorch:2-nvidia libarchive13-3.7.2-150600.3.17.1 as a component of Container suse/samba-client:latest libarchive13-3.7.2-150600.3.17.1 as a component of Container suse/samba-server:latest libarchive13-3.7.2-150600.3.17.1 as a component of Container suse/samba-toolbox:latest libarchive-devel-3.7.2-150600.3.17.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 libarchive13-3.7.2-150600.3.17.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 libarchive-devel-3.7.2-150600.3.17.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 libarchive13-3.7.2-150600.3.17.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 bsdtar-3.7.2-150600.3.17.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 bsdtar-3.7.2-150600.3.17.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 bsdtar-3.7.2-150600.3.17.1 as a component of openSUSE Leap 15.6 libarchive-devel-3.7.2-150600.3.17.1 as a component of openSUSE Leap 15.6 libarchive13-3.7.2-150600.3.17.1 as a component of openSUSE Leap 15.6 libarchive13-32bit-3.7.2-150600.3.17.1 as a component of openSUSE Leap 15.6 A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition. CVE-2025-5914 Container bci/spack:0.23:libarchive13-3.7.2-150600.3.17.1 Container bci/spack:latest:libarchive13-3.7.2-150600.3.17.1 Container containers/pytorch:2-nvidia:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-client:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-server:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-toolbox:latest:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bsdtar-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive-devel-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-32bit-3.7.2-150600.3.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502566-1/ https://www.suse.com/security/cve/CVE-2025-5914.html CVE-2025-5914 https://bugzilla.suse.com/1244272 SUSE Bug 1244272 A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions. CVE-2025-5915 Container bci/spack:0.23:libarchive13-3.7.2-150600.3.17.1 Container bci/spack:latest:libarchive13-3.7.2-150600.3.17.1 Container containers/pytorch:2-nvidia:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-client:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-server:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-toolbox:latest:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bsdtar-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive-devel-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-32bit-3.7.2-150600.3.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502566-1/ https://www.suse.com/security/cve/CVE-2025-5915.html CVE-2025-5915 https://bugzilla.suse.com/1244273 SUSE Bug 1244273 A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. CVE-2025-5916 Container bci/spack:0.23:libarchive13-3.7.2-150600.3.17.1 Container bci/spack:latest:libarchive13-3.7.2-150600.3.17.1 Container containers/pytorch:2-nvidia:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-client:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-server:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-toolbox:latest:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bsdtar-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive-devel-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-32bit-3.7.2-150600.3.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502566-1/ https://www.suse.com/security/cve/CVE-2025-5916.html CVE-2025-5916 https://bugzilla.suse.com/1244270 SUSE Bug 1244270 A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. CVE-2025-5917 Container bci/spack:0.23:libarchive13-3.7.2-150600.3.17.1 Container bci/spack:latest:libarchive13-3.7.2-150600.3.17.1 Container containers/pytorch:2-nvidia:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-client:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-server:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-toolbox:latest:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bsdtar-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive-devel-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-32bit-3.7.2-150600.3.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502566-1/ https://www.suse.com/security/cve/CVE-2025-5917.html CVE-2025-5917 https://bugzilla.suse.com/1244332 SUSE Bug 1244332 A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition. CVE-2025-5918 Container bci/spack:0.23:libarchive13-3.7.2-150600.3.17.1 Container bci/spack:latest:libarchive13-3.7.2-150600.3.17.1 Container containers/pytorch:2-nvidia:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-client:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-server:latest:libarchive13-3.7.2-150600.3.17.1 Container suse/samba-toolbox:latest:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive-devel-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Basesystem 15 SP7:libarchive13-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP6:bsdtar-3.7.2-150600.3.17.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:bsdtar-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive-devel-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-3.7.2-150600.3.17.1 openSUSE Leap 15.6:libarchive13-32bit-3.7.2-150600.3.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202502566-1/ https://www.suse.com/security/cve/CVE-2025-5918.html CVE-2025-5918 https://bugzilla.suse.com/1244279 SUSE Bug 1244279