Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2022-36227

kritik

CVE-2022-36227

libarchive: NULL pointer dereference in archive_write.c

Yayın Değişiklik CWE 476
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, CBL-Mariner, Julia, Photon OS. Daha düşük diyenler: Red Hat (düşük), AlmaLinux (düşük), Amazon (düşük), Oracle (düşük), Rocky Linux (düşük), Ubuntu (düşük).

Açıklama

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
CBL-Mariner 1.0libarchive0:3.6.1-2.cm1
CBL-Mariner 2.0libarchive0:3.6.1-2.cm2
julia::Julia Ecosystem Security AdvisoriesLibArchive_jll3.7.4+0
Photon OS 3.0libarchive3.3.3-9.ph3
Photon OS 4.0libarchive, libarchive-devel3.4.3-8.ph4
Photon OS 5.0libarchive, libarchive-devel3.7.1-1.ph5
alma 8bsdtar, libarchive, libarchive-devel3.3.3-5.el8
alma 9bsdtar, libarchive, libarchive-devel3.5.3-4.el9
alpine 3.14libarchive3.5.3-r1
alpine 3.15libarchive3.6.1-r1
alpine 3.16libarchive3.6.1-r1
alpine 3.17libarchive3.6.1-r2
46 kaynaktaki 84 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
CBL-Mariner 1.0libarchive0:3.6.1-2.cm1
CBL-Mariner 2.0libarchive0:3.6.1-2.cm2
julia::Julia Ecosystem Security AdvisoriesLibArchive_jll3.7.4+0
Photon OS 3.0libarchive3.3.3-9.ph3
Photon OS 4.0libarchive3.4.3-8.ph4
Photon OS 4.0libarchive-devel3.4.3-8.ph4
Photon OS 5.0libarchive3.7.1-1.ph5
Photon OS 5.0libarchive-devel3.7.1-1.ph5
alma 8bsdtar3.3.3-5.el8
alma 8libarchive3.3.3-5.el8
alma 8libarchive-devel3.3.3-5.el8
alma 9bsdtar3.5.3-4.el9
alma 9libarchive3.5.3-4.el9
alma 9libarchive-devel3.5.3-4.el9
alpine 3.14libarchive3.5.3-r1
alpine 3.15libarchive3.6.1-r1
alpine 3.16libarchive3.6.1-r1
alpine 3.17libarchive3.6.1-r2
alpine 3.18libarchive3.6.1-r2
alpine 3.19libarchive3.6.1-r2
alpine 3.20libarchive3.6.1-r2
alpine 3.21libarchive3.6.1-r2
alpine 3.22libarchive3.6.1-r2
alpine 3.23libarchive3.6.1-r2
alpine 3.24libarchive3.6.1-r2
alpine edgelibarchive3.6.1-r2
amazon linux 2bsdcpio3.1.2-14.amzn2.0.2
amazon linux 2bsdtar3.1.2-14.amzn2.0.2
amazon linux 2libarchive3.1.2-14.amzn2.0.2
amazon linux 2libarchive-debuginfo3.1.2-14.amzn2.0.2
amazon linux 2libarchive-devel3.1.2-14.amzn2.0.2
amazon linux 2023bsdcat3.5.3-2.amzn2023.0.3
amazon linux 2023bsdcat-debuginfo3.5.3-2.amzn2023.0.3
amazon linux 2023bsdcpio3.5.3-2.amzn2023.0.3
amazon linux 2023bsdcpio-debuginfo3.5.3-2.amzn2023.0.3
amazon linux 2023bsdtar3.5.3-2.amzn2023.0.3
amazon linux 2023bsdtar-debuginfo3.5.3-2.amzn2023.0.3
amazon linux 2023libarchive3.5.3-2.amzn2023.0.3
amazon linux 2023libarchive-debuginfo3.5.3-2.amzn2023.0.3
amazon linux 2023libarchive-debugsource3.5.3-2.amzn2023.0.3
amazon linux 2023libarchive-devel3.5.3-2.amzn2023.0.3
chainguardlibarchive3.6.1-r2
conan::GitLab Advisory Database Communitylibarchive3.6.2
debian 10libarchive3.3.3-4+deb10u3
debian 11libarchive3.4.3-2+deb11u2
debian 12libarchive3.6.2-1
debian 13libarchive3.6.2-1
debian 14libarchive3.6.2-1
echolibarchive3.6.2-1
Oracle Linux 8bsdtar3.3.3-5.el8
Oracle Linux 8libarchive3.3.3-5.el8
Oracle Linux 8libarchive-devel3.3.3-5.el8
Oracle Linux 9bsdtar3.5.3-4.el9
Oracle Linux 9libarchive3.5.3-4.el9
Oracle Linux 9libarchive-devel3.5.3-4.el9
rapidfort amazon linux 2023bsdcat3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023bsdcpio3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023bsdtar3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023libarchive0:3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023libarchive-devel3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023rf-bsdcat3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023rf-bsdcpio3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023rf-bsdtar3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023rf-libarchive0:3.5.3-2.amzn2023.0.3
rapidfort amazon linux 2023rf-libarchive-devel3.5.3-2.amzn2023.0.3
rapidfort Oracle Linux 9bsdtar0:3.5.3-4.el9
rapidfort Oracle Linux 9libarchive0:3.5.3-4.el9
Red Hatbsdcpiodüzeltme belirtilmemiş
Red Hatbsdtardüzeltme belirtilmemiş
Red Hatlibarchivedüzeltme belirtilmemiş
Red Hatlibarchive-develdüzeltme belirtilmemiş
rocky 8bsdtar3.3.3-5.el8
rocky 8libarchive3.3.3-5.el8
root.io debian 11rootio-libarchive3.4.3-2+deb11u2
root.io debian 12rootio-libarchive3.6.2-1
seal Red Hat 8libarchive3.3.3-5.el8+sp999
seal Red Hat 8seal-libarchive3.3.3-5.el8+sp999
ubuntu 14.04-ESMlibarchive3.1.2-7ubuntu2.8+esm3
ubuntu 16.04-ESMlibarchive3.1.2-11ubuntu0.16.04.8+esm1
ubuntu 18.04-ESMlibarchive3.2.2-3.1ubuntu0.7+esm1
ubuntu 20.04libarchive3.4.0-2ubuntu1.3
ubuntu 20.04-ESMlibarchive3.4.0-2ubuntu1.3
ubuntu 22.04libarchive3.6.0-1ubuntu1.2
wolfilibarchive3.6.1-r2

Referanslar

22 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.