CVE-2024-48615

Publication date 28 March 2025

Last updated 2 April 2025

Ubuntu priority

Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function header_pax_extension at rchive_read_support_format_tar.c:1844:8.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libarchive	24.10 oracular	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

How can I get the fixes?
What do statuses mean?
Patch details

Notes

mdeslaur

introduced in 3.7.5 by: https://github.com/libarchive/libarchive/commit/2d8a5760c5ec553283a95a1aaca746f6eb472d0f

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libarchive	Upstream: 565b5ae

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2024-48615
https://github.com/88Sanghy88/crash-test
https://github.com/libarchive/libarchive/releases/download/v3.7.6/libarchive-3.7.6.tar.gz