Security update for libarchive SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:20560-1 Final 1 1 2025-08-20T11:38:12Z current 2025-08-20T11:38:12Z 2025-08-20T11:38:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libarchive This update for libarchive fixes the following issues: - CVE-2025-5914: Fixed double free due to an integer overflow in the archive_read_format_rar_seek_data() function (bsc#1244272) - CVE-2025-5915: Fixed heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c (bsc#1244273) - CVE-2025-5916: Fixed integer overflow while reading warc files at archive_read_support_format_warc.c (bsc#1244270) - CVE-2025-5917: Fixed off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c (bsc#1244336) - CVE-2025-5918: Fixed past EOF read triggered for piped file streams (bsc#1244279) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Micro-6.0-427 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202520560-1/ Link for SUSE-SU-2025:20560-1 https://lists.suse.com/pipermail/sle-security-updates/2025-August/022320.html E-Mail link for SUSE-SU-2025:20560-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1244270 SUSE Bug 1244270 https://bugzilla.suse.com/1244272 SUSE Bug 1244272 https://bugzilla.suse.com/1244273 SUSE Bug 1244273 https://bugzilla.suse.com/1244279 SUSE Bug 1244279 https://bugzilla.suse.com/1244336 SUSE Bug 1244336 https://www.suse.com/security/cve/CVE-2025-5914/ SUSE CVE CVE-2025-5914 page https://www.suse.com/security/cve/CVE-2025-5915/ SUSE CVE CVE-2025-5915 page https://www.suse.com/security/cve/CVE-2025-5916/ SUSE CVE CVE-2025-5916 page https://www.suse.com/security/cve/CVE-2025-5917/ SUSE CVE CVE-2025-5917 page https://www.suse.com/security/cve/CVE-2025-5918/ SUSE CVE CVE-2025-5918 page SUSE Linux Micro 6.0 libarchive13-3.6.2-5.1 libarchive13-3.6.2-5.1 as a component of SUSE Linux Micro 6.0 A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition. CVE-2025-5914 SUSE Linux Micro 6.0:libarchive13-3.6.2-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520560-1/ https://www.suse.com/security/cve/CVE-2025-5914.html CVE-2025-5914 https://bugzilla.suse.com/1244272 SUSE Bug 1244272 A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions. CVE-2025-5915 SUSE Linux Micro 6.0:libarchive13-3.6.2-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520560-1/ https://www.suse.com/security/cve/CVE-2025-5915.html CVE-2025-5915 https://bugzilla.suse.com/1244273 SUSE Bug 1244273 A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. CVE-2025-5916 SUSE Linux Micro 6.0:libarchive13-3.6.2-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520560-1/ https://www.suse.com/security/cve/CVE-2025-5916.html CVE-2025-5916 https://bugzilla.suse.com/1244270 SUSE Bug 1244270 A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. CVE-2025-5917 SUSE Linux Micro 6.0:libarchive13-3.6.2-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520560-1/ https://www.suse.com/security/cve/CVE-2025-5917.html CVE-2025-5917 https://bugzilla.suse.com/1244332 SUSE Bug 1244332 A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition. CVE-2025-5918 SUSE Linux Micro 6.0:libarchive13-3.6.2-5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520560-1/ https://www.suse.com/security/cve/CVE-2025-5918.html CVE-2025-5918 https://bugzilla.suse.com/1244279 SUSE Bug 1244279