JLSEC-2025-237

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-237.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-237.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2025-237

Upstream

CVE-2022-36227

Published

2025-11-25T22:03:17.636Z

Modified

2025-11-25T22:33:19.969236Z

Summary

In libarchive before 3.6.2, the software does not check for an error after calling calloc function t...

Details

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

Database specific

{
    "sources": [
        {
            "id": "CVE-2022-36227",
            "published": "2022-11-22T02:15:11.003Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-36227",
            "modified": "2025-11-03T22:15:59.710Z",
            "imported": "2025-11-25T21:58:26.863Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36227"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / LibArchive_jll

Package

Name: LibArchive_jll
Purl: pkg:julia/LibArchive_jll?uuid=1e303b3e-d4db-56ce-88c4-91e52606a1a8

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.4+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-237.json"