CVE-2018-1000879: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 3.4% chance of exploitation in the next 30 days.

libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.

Affected products

• Fedoraproject Fedora: version 28 only; version 29 only; version 30 only
• Libarchive Libarchive: from 3.3.0, before 3.4.0 (fixed in 3.4.0)
• Opensuse Leap: version 15.0 only

Published 2018-12-20. Last modified 2026-10-08.