{"id":"CVE-2022-36227","revision":"6f9de3b649ab402fbea2c0047a78bc0d","records":[{"revision":"6f9de3b649ab402fbea2c0047a78bc0d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2022-36227","aliases":[],"title":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites th…","description":"In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: \"In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.\"","state":0,"publishedAt":"2022-11-22T00:00:00+00:00","modifiedAt":"2026-10-08T21:03:23.04+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"n/a\",\n                    \"product\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"version\": \"n/a\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/libarchive/libarchive/issues/1754","https://bugs.gentoo.org/882521","https://github.com/libarchive/libarchive/blob/v3.0.0a/libarchive/archive_write.c#L215","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V67OO2UUQAUJS3IK4JZPF6F3LUCBU6IS/","https://lists.debian.org/debian-lts-announce/2023/01/msg00034.html","https://security.gentoo.org/glsa/202309-14"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-36227","license":"CVE Program Terms of Use","key":"cve-program:CVE-2022-36227","identifiers":["CVE-2022-36227"]},"retained":false,"historicalAffected":[]}],"coverage":[]}