CVE-2022-36227

Name	CVE-2022-36227
Description	In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3294-1, DLA-3950-1, ELA-790-1
Debian Bugs	1024669

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libarchive (PTS)	jessie, jessie (lts)	3.1.2-11+deb8u12	fixed
	stretch (security)	3.2.2-2+deb9u3	vulnerable
	stretch (lts), stretch	3.2.2-2+deb9u5	fixed
	buster, buster (lts)	3.3.3-4+deb10u4	fixed
	buster (security)	3.3.3-4+deb10u3	fixed
	bullseye	3.4.3-2+deb11u1	vulnerable
	bullseye (security)	3.4.3-2+deb11u2	fixed
	bookworm	3.6.2-1+deb12u1	fixed
	bookworm (security)	3.6.2-1+deb12u2	fixed
	sid, trixie	3.7.4-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libarchive	source	jessie	3.1.2-11+deb8u10	ELA-790-1
libarchive	source	stretch	3.2.2-2+deb9u4	ELA-790-1
libarchive	source	buster	3.3.3-4+deb10u3	DLA-3294-1
libarchive	source	bullseye	3.4.3-2+deb11u2	DLA-3950-1
libarchive	source	(unstable)	3.6.2-1		1024669

Notes

https://github.com/libarchive/libarchive/issues/1754
https://github.com/libarchive/libarchive/pull/1759
Fixed by: https://github.com/libarchive/libarchive/commit/bff38efe8c110469c5080d387bec62a6ca15b1a5