Skip to content
Fencer Vulns
critical 9.8

CVE-2022-36227 json

In libarchive before 3.6.2, the software does not check for an error after calling calloc function...

published 2022-11-22 3 y ago modified 2026-10-08 31 d ago also EUVD-2022-38946 , JLSEC-2025-237

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

Patch / fix

  • julia LibArchive_jll 3.7.4+0
  • libarchive libarchive 3.6.2
  • splunk universal_forwarder 8.2.12, 9.0.6
  • libarchive Debian 14, Debian 13, Debian 12 3.6.2-1

debian advisories DEBIAN-CVE-2022-36227

  • libarchive Ubuntu 20.04 LTS 3.4.0-2ubuntu1.3
  • libarchive Ubuntu 22.04 LTS 3.6.0-1ubuntu1.2
  • libarchive Ubuntu Pro 14.04 LTS 3.1.2-7ubuntu2.8+esm3
  • libarchive Ubuntu Pro 16.04 LTS 3.1.2-11ubuntu0.16.04.8+esm1
  • libarchive Ubuntu Pro 18.04 LTS 3.2.2-3.1ubuntu0.7+esm1

ubuntu advisories UBUNTU-CVE-2022-36227

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libarchive RHEL 8 3.3.3-5.el8
  • bsdtar RHEL 8 3.3.3-5.el8
  • libarchive RHEL 9 3.5.3-4.el9
  • bsdtar RHEL 9 3.5.3-4.el9
  • libarchive RHEL 8.6 EUS 3.3.3-4.el8_6
  • bsdtar RHEL 8.6 EUS 3.3.3-4.el8_6

red hat advisories RHSA-2024:0146RHSA-2023:3018RHSA-2023:2532

  • libarchive SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 3.3.3-32.8.1
  • libarchive SLE Module for Development Tools 15 SP4, SLE Module for Basesystem 15 SP4, SLE Micro 5.3 +2 more 3.5.1-150400.3.12.1
  • libarchive SLE Module for Development Tools 15 SP3, SLE Module for Basesystem 15 SP3, openSUSE Leap 15.3 3.4.2-150200.4.15.1

suse advisories SUSE-SU-2022:4296-1SUSE-SU-2022:4209-1SUSE-SU-2022:4202-1

  • bsdtar openSUSE Tumbleweed 3.6.2-1.1

opensuse advisories openSUSE-SU-2024:12588-1

  • libarchive AlmaLinux 8 3.3.3-5.el8
  • bsdtar AlmaLinux 8 3.3.3-5.el8
  • libarchive AlmaLinux 9 3.5.3-4.el9
  • bsdtar AlmaLinux 9 3.5.3-4.el9

almalinux advisories ALSA-2023:3018ALSA-2023:2532

  • libarchive Rocky Linux 8 3.3.3-5.el8

rocky linux advisories RLSA-2023:3018

  • libarchive Alpine 3.14 3.5.3-r1
  • libarchive Alpine 3.16, Alpine 3.15 3.6.1-r1
  • libarchive Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 3.6.1-r2

alpine advisories ALPINE-CVE-2022-36227

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libarchive CBL-Mariner 2.0 3.6.1-2

azure linux advisories AZL-11470

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-36227 updated cvss 5.9

libarchive: NULL pointer dereference in archive_write.c

  • Red Hat Enterprise Linux 6 libarchive Red Hat Enterprise Linux 7 bsdtar, bsdcpio, libarchive
    affected: no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder EUS (v.8.6) bsdcat-debuginfo 3.3.3-4.el8_6, bsdtar-debuginfo 3.3.3-4.el8_6, libarchive-devel 3.3.3-4.el8_6, bsdcpio-debuginfo 3.3.3-4.el8_6, libarchive-debuginfo 3.3.3-4.el8_6, libarchive-debugsource 3.3.3-4.el8_6
    fixed: vendor fix RHSA-2024:0146
  • Red Hat Enterprise Linux AppStream (v. 9) bsdtar 3.5.3-4.el9
    fixed: vendor fix RHSA-2023:2532
  • Red Hat Enterprise Linux BaseOS (v. 8) bsdtar 3.3.3-5.el8, libarchive 3.3.3-5.el8
    fixed: vendor fix RHSA-2023:3018
  • Red Hat Enterprise Linux BaseOS (v. 9) libarchive 3.5.3-4.el9
    fixed: vendor fix RHSA-2023:2532
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) bsdtar 3.3.3-4.el8_6, libarchive 3.3.3-4.el8_6
    fixed: vendor fix RHSA-2024:0146
  • Red Hat Enterprise Linux CRB (v. 8) bsdcat-debuginfo 3.3.3-5.el8, bsdtar-debuginfo 3.3.3-5.el8, libarchive-devel 3.3.3-5.el8, bsdcpio-debuginfo 3.3.3-5.el8, libarchive-debuginfo 3.3.3-5.el8, libarchive-debugsource 3.3.3-5.el8
    fixed: vendor fix RHSA-2023:3018
  • Red Hat Enterprise Linux CRB (v. 9) bsdcat-debuginfo 3.5.3-4.el9, bsdtar-debuginfo 3.5.3-4.el9, libarchive-devel 3.5.3-4.el9, bsdcpio-debuginfo 3.5.3-4.el9, libarchive-debuginfo 3.5.3-4.el9, libarchive-debugsource 3.5.3-4.el9
    fixed: vendor fix RHSA-2023:2532

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 9.8

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
31 d ago

Exploit prediction

2.46% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia LibArchive_jll
<3.7.4+0
3.7.4+0

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.