CyberRota Analysis
AI-GeneratedThe vulnerability exists in libarchive versions 3.8.x prior to 3.8.2, where a heap-based buffer overflow can occur in the gzip writer due to improper handling of the original-filename field. Although the risk of exploitation is low and requires an attacker to provide a malicious filename, it could potentially lead to arbitrary code execution in specific scenarios. Organizations using libarchive, particularly those handling untrusted input, should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Exploitation envisions a marginally plausible scenario in which original-filename is obtained from an untrusted party. (original-filename is not derived from the input data.)