CVE-2024-37407

An out-of-bounds access flaw was found in libarchive in the slurp_central_directory function at archive_read_support_format_zip.c. This vulnerability may be triggered if a ZIP archive has an empty name and the mac-ext is enabled.

This vulnerability in libarchive is rated with an Important severity because it involves an out-of-bounds access when processing ZIP archives with empty filenames and the mac-ext option enabled. Such vulnerabilities can lead to undefined behavior, including potential exploitation by attackers to execute arbitrary code, causing a denial of service, or exfiltrating sensitive information. The flaw lies in the slurp_central_directory function within archive_read_support_format_zip.c, where improper handling of file names leads to memory access violations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.