CVE catalog

CVE-2025-1632

libarchive vulnerabilities

Severity: Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: Feb 24, 2025, 1:31:08 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 25, 2026

A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libarchive	sid	`3.8.10-2`	fixed
Debian	libarchive	forky	`3.8.9-1`	fixed
Debian	libarchive	trixie	`3.7.4-4+deb13u1`	fixed
Debian	libarchive	bookworm	`3.6.2-1+deb12u4`	vulnerable
Debian	libarchive	bookworm-security	`3.6.2-1+deb12u5`	vulnerable
Ubuntu	libarchive	noble	Not reported	vulnerable
Ubuntu	libarchive	noble	`3.7.2-2ubuntu0.4`	fixed
Ubuntu	libarchive-dev	noble	`3.7.2-2ubuntu0.4`	fixed
Ubuntu	libarchive-tools	noble	`3.7.2-2ubuntu0.4`	fixed
Ubuntu	libarchive13t64	noble	`3.7.2-2ubuntu0.4`	fixed
Alpine	libarchive	3.18	`3.7.9-r0`	fixed
Alpine	libarchive	3.19	`3.7.9-r0`	fixed
Alpine	libarchive	3.20	`3.7.9-r0`	fixed
Alpine	libarchive	3.21	`3.7.9-r0`	fixed
Alpine	libarchive	3.22	`3.7.9-r0`	fixed
Alpine	libarchive	3.23	`3.7.9-r0`	fixed
Alpine	libarchive	3.24	`3.7.9-r0`	fixed
Ubuntu	libarchive	24.04	`3.6.2-1ubuntu1`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-1ubuntu1`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-1ubuntu2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-1.1ubuntu2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.1`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.3`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.4`	fixed
Ubuntu	libarchive	20.04	`3.4.0-1`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-1build1`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-1ubuntu2`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-2ubuntu1`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-2ubuntu1.1`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-2ubuntu1.2`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-2ubuntu1.3`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-2ubuntu1.4`	vulnerable
Ubuntu	libarchive	20.04	`3.4.0-2ubuntu1.5`	fixed
Ubuntu	libarchive	22.04	`3.4.3-2`	vulnerable
Ubuntu	libarchive	22.04	`3.4.3-2build1`	vulnerable
Ubuntu	libarchive	22.04	`3.5.2-1`	vulnerable
Ubuntu	libarchive	22.04	`3.5.2-1ubuntu1`	vulnerable
Ubuntu	libarchive	22.04	`3.6.0-1ubuntu1`	vulnerable
Ubuntu	libarchive	22.04	`3.6.0-1ubuntu1.1`	vulnerable
Ubuntu	libarchive	22.04	`3.6.0-1ubuntu1.2`	vulnerable
Ubuntu	libarchive	22.04	`3.6.0-1ubuntu1.3`	vulnerable
Ubuntu	libarchive	22.04	`3.6.0-1ubuntu1.4`	fixed
Ubuntu	libarchive	24.04	`3.6.2-1ubuntu1`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-1ubuntu1`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-1ubuntu2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-1.1ubuntu2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.1`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.2`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.3`	vulnerable
Ubuntu	libarchive	24.04	`3.7.2-2ubuntu0.4`	fixed
Suse	libarchive	linux enterprise module for basesystem 15 sp6	`3.7.2-150600.3.12.1`	fixed
Suse	libarchive	linux enterprise module for development tools 15 sp6	`3.7.2-150600.3.12.1`	fixed
Opensuse	libarchive	leap 15.6	`3.7.2-150600.3.12.1`	fixed
Opensuse	libarchive	tumbleweed	`3.7.7-3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libarchive	source	sid	`3.7.4-2`	unimportant	Not reported	[1103494]
Debian	libarchive	source	forky	`3.7.4-2`	unimportant	Not reported	[1103494]
Debian	libarchive	source	trixie	`3.7.4-2`	unimportant	Not reported	[1103494]
Debian	libarchive	source	bookworm	`(unfixed)`	unimportant	Not reported	[1103494]
Ubuntu	libarchive	deb	noble	`3.7.2-2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	libarchive-dev	deb	noble	`3.7.2-2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	libarchive-tools	deb	noble	`3.7.2-2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	libarchive13t64	deb	noble	`3.7.2-2ubuntu0.4`	Not reported	Not reported	Not reported
Alpine	libarchive	apk	3.18	`3.7.9-r0`	Not reported	ALPINE-CVE-2025-1632	Not reported
Alpine	libarchive	apk	3.19	`3.7.9-r0`	Not reported	ALPINE-CVE-2025-1632	Not reported
Alpine	libarchive	apk	3.20	`3.7.9-r0`	Not reported	ALPINE-CVE-2025-1632	Not reported
Alpine	libarchive	apk	3.21	`3.7.9-r0`	Not reported	ALPINE-CVE-2025-1632	Not reported
Alpine	libarchive	apk	3.22	`3.7.9-r0`	Not reported	ALPINE-CVE-2025-1632	Not reported
Alpine	libarchive	apk	3.23	`3.7.9-r0`	Not reported	ALPINE-CVE-2025-1632	Not reported
Alpine	libarchive	apk	3.24	`3.7.9-r0`	Not reported	ALPINE-CVE-2025-1632	Not reported
Ubuntu	libarchive	deb	24.04	`3.7.2-2ubuntu0.4`	Not reported	UBUNTU-CVE-2025-1632	Not reported
Ubuntu	libarchive	deb	20.04	`3.4.0-2ubuntu1.5`	Not reported	USN-7454-1	Not reported
Ubuntu	libarchive	deb	22.04	`3.6.0-1ubuntu1.4`	Not reported	USN-7454-1	Not reported
Ubuntu	libarchive	deb	24.04	`3.7.2-2ubuntu0.4`	Not reported	USN-7454-1	Not reported
Suse	libarchive	rpm	linux enterprise module for basesystem 15 sp6	`3.7.2-150600.3.12.1`	Not reported	SUSE-SU-2025:0985-1	Not reported
Suse	libarchive	rpm	linux enterprise module for development tools 15 sp6	`3.7.2-150600.3.12.1`	Not reported	SUSE-SU-2025:0985-1	Not reported
Opensuse	libarchive	rpm	leap 15.6	`3.7.2-150600.3.12.1`	Not reported	SUSE-SU-2025:0985-1	Not reported
Opensuse	libarchive	rpm	tumbleweed	`3.7.7-3.1`	Not reported	OPENSUSE-SU-2025:14882-1	Not reported

[Debian bug #1103494]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libarchive13]Affected
Source package: [libarchive]
Details (4)
- 3.6.2-1+deb12u4 · amd64 · bookworm
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u4 · arm64 · bookworm
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u5 · amd64 · bookworm-security
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u5 · arm64 · bookworm-security
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
[libarchive-dev]Affected
Source package: [libarchive]
Details (4)
- 3.6.2-1+deb12u4 · amd64 · bookworm
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u4 · arm64 · bookworm
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u5 · amd64 · bookworm-security
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u5 · arm64 · bookworm-security
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
[libarchive-tools]Affected
Source package: [libarchive]
Details (4)
- 3.6.2-1+deb12u4 · amd64 · bookworm
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u4 · arm64 · bookworm
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u5 · amd64 · bookworm-security
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12
- 3.6.2-1+deb12u5 · arm64 · bookworm-security
  Affected
  usn · libarchive · debian · bookworm; usn · libarchive · debian · 12

[openSUSE Tumbleweed]

[bsdtar]Unknown
Source package: [libarchive]
Details (1)
- 3.8.7-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 3.7.7-3.1
  Version impact unknown
  usn · libarchive · opensuse · tumbleweed
[libarchive13]Unknown
Source package: [libarchive]
Details (1)
- 3.8.7-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 3.7.7-3.1
  Version impact unknown
  usn · libarchive · opensuse · tumbleweed
[libarchive13-32bit]Unknown
Source package: [libarchive]
Details (1)
- 3.8.7-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 3.7.7-3.1
  Version impact unknown
  usn · libarchive · opensuse · tumbleweed
[libarchive-devel]Unknown
Source package: [libarchive]
Details (1)
- 3.8.7-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 3.7.7-3.1
  Version impact unknown
  usn · libarchive · opensuse · tumbleweed

[Debian 13 (Trixie)]

[libarchive13t64]Fixed
Source package: [libarchive]
Details (2)
- 3.7.4-4+deb13u1 · amd64 · trixie
  Fixed · Fixed: 3.7.4-2
  usn · libarchive · debian · 13
- 3.7.4-4+deb13u1 · arm64 · trixie
  Fixed · Fixed: 3.7.4-2
  usn · libarchive · debian · 13
[libarchive-dev]Fixed
Source package: [libarchive]
Details (2)
- 3.7.4-4+deb13u1 · amd64 · trixie
  Fixed · Fixed: 3.7.4-2
  usn · libarchive · debian · 13
- 3.7.4-4+deb13u1 · arm64 · trixie
  Fixed · Fixed: 3.7.4-2
  usn · libarchive · debian · 13
[libarchive-tools]Fixed
Source package: [libarchive]
Details (2)
- 3.7.4-4+deb13u1 · amd64 · trixie
  Fixed · Fixed: 3.7.4-2
  usn · libarchive · debian · 13
- 3.7.4-4+deb13u1 · arm64 · trixie
  Fixed · Fixed: 3.7.4-2
  usn · libarchive · debian · 13

Observed: Oct 26, 2026, 11:18:40 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]