Medium severity6.5NVD Advisory· Published Jul 20, 2021· Updated Jun 17, 2026
CVE-2021-36976
CVE-2021-36976
Description
libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
22cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*range: >=3.4.1,<=3.5.2
- (no CPE)range: 3.4.1 - 3.5.1
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*range: >=8.2.0,<8.2.12
- cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- libarchive/libarchivedescription
- osv-coords12 versionspkg:rpm/opensuse/bsdtar&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/libarchive&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/libarchive&distro=openSUSE%20Leap%2015.4pkg:rpm/suse/libarchive&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP3pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP2pkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/libarchive&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2
< 3.6.0-1.1+ 11 more
- (no CPE)range: < 3.6.0-1.1
- (no CPE)range: < 3.4.2-150200.4.3.1
- (no CPE)range: < 3.5.1-150400.3.3.1
- (no CPE)range: < 3.4.2-150200.4.3.1
- (no CPE)range: < 3.4.2-150200.4.3.1
- (no CPE)range: < 3.4.2-150200.4.3.1
- (no CPE)range: < 3.5.1-150400.3.3.1
- (no CPE)range: < 3.4.2-150200.4.3.1
- (no CPE)range: < 3.5.1-150400.3.3.1
- (no CPE)range: < 3.4.2-150200.4.3.1
- (no CPE)range: < 3.4.2-150200.4.3.1
- (no CPE)range: < 3.4.2-150200.4.3.1
Patches
Vulnerability mechanics
References
11- seclists.org/fulldisclosure/2022/Mar/27nvdMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Mar/28nvdMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2022/Mar/29nvdMailing ListThird Party Advisory
- bugs.chromium.org/p/oss-fuzz/issues/detailnvdIssue TrackingThird Party Advisory
- github.com/google/oss-fuzz-vulns/blob/main/vulns/libarchive/OSV-2021-557.yamlnvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SE5NJQNM22ZE5Z55LPAGCUHSBQZBKMKC/nvdMailing ListThird Party Advisory
- security.gentoo.org/glsa/202208-26nvdThird Party Advisory
- support.apple.com/kb/HT213182nvdThird Party Advisory
- support.apple.com/kb/HT213183nvdThird Party Advisory
- support.apple.com/kb/HT213193nvdThird Party Advisory
- lists.debian.org/debian-lts-announce/2024/11/msg00007.htmlnvd
News mentions
0No linked articles in our index yet.