CVE-2024-26256

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26256
Libarchive Remote Code Execution Vulnerability

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26256 Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/06/04/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/06/05/1 Mailing List
https://github.com/LeSuisse/nixpkgs/commit/81b82a2934521dffef76f7ca305d8d4e22fe7262 Patch
https://github.com/libarchive/libarchive/commit/eb7939b24a681a04648a59cdebd386b1e9dc9237.patch Patch
https://github.com/libarchive/libarchive/releases/tag/v3.7.4 Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWANFZ6NEMXFCALXWI2AFKYBOLONAVFC/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TWAMR5TY47UKVYMWQXB34CWSBNTRYMBV/ Mailing List
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26256 Third Party Advisory
https://www.openwall.com/lists/oss-security/2024/06/04/2 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
History

08 Jan 2025, 16:03

Type Values Removed Values Added
First Time Libarchive
Microsoft windows 11 22h2
Microsoft windows 11 23h2
Fedoraproject
Libarchive libarchive
Microsoft windows Server 2022 23h2
Microsoft
Fedoraproject fedora
CPE cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26256 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26256 - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/06/04/2 - () http://www.openwall.com/lists/oss-security/2024/06/04/2 - Mailing List
References () http://www.openwall.com/lists/oss-security/2024/06/05/1 - () http://www.openwall.com/lists/oss-security/2024/06/05/1 - Mailing List
References () https://github.com/LeSuisse/nixpkgs/commit/81b82a2934521dffef76f7ca305d8d4e22fe7262 - () https://github.com/LeSuisse/nixpkgs/commit/81b82a2934521dffef76f7ca305d8d4e22fe7262 - Patch
References () https://github.com/libarchive/libarchive/commit/eb7939b24a681a04648a59cdebd386b1e9dc9237.patch - () https://github.com/libarchive/libarchive/commit/eb7939b24a681a04648a59cdebd386b1e9dc9237.patch - Patch
References () https://github.com/libarchive/libarchive/releases/tag/v3.7.4 - () https://github.com/libarchive/libarchive/releases/tag/v3.7.4 - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWANFZ6NEMXFCALXWI2AFKYBOLONAVFC/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWANFZ6NEMXFCALXWI2AFKYBOLONAVFC/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TWAMR5TY47UKVYMWQXB34CWSBNTRYMBV/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TWAMR5TY47UKVYMWQXB34CWSBNTRYMBV/ - Mailing List
References () https://www.openwall.com/lists/oss-security/2024/06/04/2 - () https://www.openwall.com/lists/oss-security/2024/06/04/2 - Mailing List
CWE CWE-787
Information

Published : 2024-04-09 17:15

Updated : 2025-01-08 16:03

NVD link : CVE-2024-26256

Mitre link : CVE-2024-26256

CVE.ORG link : CVE-2024-26256

JSON object : View

Products Affected

libarchive

  • libarchive

fedoraproject

  • fedora

microsoft

  • windows_11_23h2
  • windows_11_22h2
  • windows_server_2022_23h2
CWE
CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write