GCVE - cpe:2.3:a:libarchive:libarchive:3.2.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:libarchive:libarchive:3.2.2:*:*:*:*:*:*:*

part: a version: 3.2.2 update: *

Vendor	Libarchive (`c09cb5c4-d86d-52ea-8f70-142deb63c4f4`)
Product	Libarchive (`04daf0c2-7688-5964-9e13-5f548205786c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/vaporoid/libarchive`	purl2cpe	2026-06-01 10:18:12.934861
`pkg:deb/debian/libarchive`	purl2cpe	2026-06-01 10:18:12.934862
`pkg:deb/ubuntu/libarchive`	purl2cpe	2026-06-01 10:18:12.934864
`pkg:github/libarchive/libarchive`	purl2cpe	2026-06-01 10:18:12.934865
`pkg:gitlab/redhat/libarchive`	purl2cpe	2026-06-01 10:18:12.934867
`pkg:rpm/opensuse/libarchive`	purl2cpe	2026-06-01 10:18:12.934869

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-5601`	vulnerable	2026-06-08 05:09:47.318203	Details available An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive. Published: 2017-01-27T22:01:00.000Z Updated: 2024-08-05T15:04:15.336Z Open on db.gcve.eu Reference links https://secunia.com/secunia_research/2017-3/ https://github.com/libarchive/libarchive/commit/98dcbbf0bf4854bf987557e55e55fff7abbf3ea9 http://www.securityfocus.com/bid/95837 https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html http://www.securitytracker.com/id/1037974	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10350`	vulnerable	2026-06-08 05:07:17.791550	Details available The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. Published: 2017-05-01T01:00:00.000Z Updated: 2024-08-06T03:21:50.819Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html https://github.com/libarchive/libarchive/issues/835 https://www.debian.org/security/2018/dsa-4360 https://security.gentoo.org/glsa/201710-19 https://usn.ubuntu.com/3736-1/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10349`	vulnerable	2026-06-08 05:07:17.791197	Details available The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file. Published: 2017-05-01T01:00:00.000Z Updated: 2024-08-06T03:21:50.837Z Open on db.gcve.eu Reference links https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html https://www.debian.org/security/2018/dsa-4360 https://security.gentoo.org/glsa/201710-19 https://usn.ubuntu.com/3736-1/ https://github.com/libarchive/libarchive/issues/834	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10209`	vulnerable	2026-06-08 05:07:17.583298	Details available The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file. Published: 2017-04-03T05:44:00.000Z Updated: 2024-08-06T03:14:42.918Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/97327 https://github.com/libarchive/libarchive/issues/842 https://lists.debian.org/debian-lts-announce/2018/11/msg00037.html https://www.debian.org/security/2018/dsa-4360 https://usn.ubuntu.com/3736-1/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

libarchive 3.2.2

Notes

PURL mappings

Vulnerability references

Contribute