Hello Red Hat PSIRT,

I would like to request CVE assignment for a security vulnerability I found in libarchive.

There is a heap overflow problem while parsing a tar archive that contains a PAX extended header with the SUN.holesdata sparse-file attribute. header_pax_extension() passes the attribute value to pax_attribute() with the trailing newline excluded from the value length. The SUN.holesdata parser later treats the byte after the supplied value as if it were still part of the accessible buffer and reads it when length == 0.

More detail can be found in github issue: https://github.com/libarchive/libarchive/issues/3251
A fixed PR has been commit: https://github.com/libarchive/libarchive/pull/3253

Until send this email, I have search no public report of this flaw. I want to know if it can be assgned a CVE ID or do you need any other more detail informations.

Best regards,
Bon Voyage