CVE catalog

CVE-2017-11124

libxar-devel-1.8.0.0.503-1.1 on GA media

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.95% · Oct 25, 2026

libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxar131.8.0.498-1fixed
Debianxar141.8.0.498-1fixed
Opensusexarleap 16.01.8.0.0.503-bp160.1.1fixed
Opensusexartumbleweed1.8.0.0.503-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxardeb131.8.0.498-1Not reportedDEBIAN-CVE-2017-11124Not reported
Debianxardeb141.8.0.498-1Not reportedDEBIAN-CVE-2017-11124Not reported
Opensusexarrpmleap 16.01.8.0.0.503-bp160.1.1Not reportedOPENSUSE-SU-2026:21153-1Not reported
Opensusexarrpmtumbleweed1.8.0.0.503-1.1Not reportedOPENSUSE-SU-2026:11103-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libxar1]Unknown

    Source package: [xar]

    Details (1)

    • 1.8.0.0.503-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.8.0.0.503-1.1

      Version impact unknown

      pypi · xar · opensuse · tumbleweed

  • [libxar-devel]Unknown

    Source package: [xar]

    Details (1)

    • 1.8.0.0.503-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.8.0.0.503-1.1

      Version impact unknown

      pypi · xar · opensuse · tumbleweed

  • [xar]Fixed

    Source package: [xar]

    Details (1)

    • 1.8.0.0.503-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.8.0.0.503-1.1

      pypi · xar · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [libxar1]Fixed

    Source package: [xar]

    Details (2)

    • 1.8.0.498-2 · amd64 · trixie

      Fixed · Fixed: 1.8.0.498-1

      pypi · xar · debian · 13

    • 1.8.0.498-2 · arm64 · trixie

      Fixed · Fixed: 1.8.0.498-1

      pypi · xar · debian · 13

  • [libxar-dev]Fixed

    Source package: [xar]

    Details (2)

    • 1.8.0.498-2 · amd64 · trixie

      Fixed · Fixed: 1.8.0.498-1

      pypi · xar · debian · 13

    • 1.8.0.498-2 · arm64 · trixie

      Fixed · Fixed: 1.8.0.498-1

      pypi · xar · debian · 13

  • [xar]Fixed
    Details (2)

    • 1.8.0.498-2 · amd64 · trixie

      Fixed · Fixed: 1.8.0.498-1

      pypi · xar · debian · 13

    • 1.8.0.498-2 · arm64 · trixie

      Fixed · Fixed: 1.8.0.498-1

      pypi · xar · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]