Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2025-5914

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

En bref

Sévérité
HIGH 7.8
EPSS
EPSS 0.47 % · centile 41 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Modified

Description

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hredhat
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD · secalert@redhat.com (Secondary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
libarchiveaffected 0 < 3.8.0
Red Hat · Red Hat Enterprise Linux 10unaffected 0:3.7.7-4.el10_0 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Supportunaffected 0:3.1.2-14.el7_9.1 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:3.3.3-6.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 0:3.3.2-8.el8_2.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 0:3.3.3-1.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onunaffected 0:3.3.3-1.el8_4.1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 0:3.3.3-6.el8_6 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 0:3.3.3-6.el8_6 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 0:3.3.3-6.el8_6 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 0:3.3.3-5.el8_8.1 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 0:3.3.3-5.el8_8.1 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:3.5.3-6.el9_6 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:3.5.3-6.el9_6 < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 0:3.5.3-2.el9_0.1 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:3.5.3-5.el9_2 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 0:3.5.3-4.el9_4.1 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected 414.92.202510211419-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.15unaffected 415.92.202601271320-0 < *
Red Hat · Red Hat OpenShift Container Platform 4.16unaffected 416.94.202601071926-0 < *

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD