linux/poky.git/meta/recipes-extended/libarchive/libarchive_3.6.2.bb, branch kirkstone

libarchive: Fix CVE-2026-4111

2026-04-10T10:53:18+00:00

Pick patch according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-4111 [2] https://github.com/libarchive/libarchive/pull/2877 [3] https://access.redhat.com/errata/RHSA-2026:5080 (From OE-Core rev: 9af05e2d56ed355c02722a24ee66b2b0d4097cb9) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: fix CVE-2025-60753 regression

2026-01-26T09:49:25+00:00

Pick patch from PR mentioned in v3.8.5 release notes. (From OE-Core rev: dc3d99c419a913e66cb73bf098291c21985b0432) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

libarchive: patch CVE-2025-60753

2025-12-01T14:50:49+00:00

Pick patch from [3] marked in [2] mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-60753 [2] https://github.com/libarchive/libarchive/issues/2725 [3] https://github.com/libarchive/libarchive/pull/2787 (From OE-Core rev: e3e9dd59a32541b36d6c1036b8f83af52bef92cd) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch 3.8.3 security issue 2

2025-12-01T14:50:49+00:00

Pick patch [2] as listed in [1]. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2768 (From OE-Core rev: 332f07635ccb4965a001f6536620c9d0b1a9c056) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch 3.8.3 security issue 1

2025-12-01T14:50:49+00:00

Pick patch [2] as listed in [1]. To apply it cleanly, add three additional patches from branch patch/3.8. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2753 (From OE-Core rev: 201eed780c73335c9278db17fe39fb453e16af08) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch regression of patch for CVE-2025-5918

2025-08-29T15:33:33+00:00

Picked commit per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-5918 (From OE-Core rev: c947e01b3c27e9f08dc55ee4939d5537318f12e3) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch CVE-2025-5918

2025-08-18T20:18:01+00:00

Pick 2 commits as in scarthgap branch plus one additional precondition to apply those. (From OE-Core rev: e43507dad134c5036be1c79a37f73c34f4fb6292) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: fix CVE-2025-5917

2025-07-14T15:37:40+00:00

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by- one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1- byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, lea ding to unpredictable program behavior, crashes, or in specific circumstances, could be lever aged as a building block for more sophisticated exploitation. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5917 Upstream-patch: https://github.com/libarchive/libarchive/commit/7c02cde37a63580cd1859183fbbd2cf04a89be85 (From OE-Core rev: 2b2a2fce345c9bfcad44cc8ef3419f43dd07b022) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libarchive: fix CVE-2025-5916

2025-07-14T15:37:40+00:00

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5916 Upstream-patch: https://github.com/libarchive/libarchive/commit/ef093729521fcf73fa4007d5ae77adfe4df42403 (From OE-Core rev: 0e939bf5fc7412c7357fcd7d8ae760f023ac40eb) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libarchive: fix CVE-2025-5915

2025-07-14T15:37:40+00:00

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap b uffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer -Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memo ry buffer, which can result in unpredictable program behavior, crashes (denial of service), o r the disclosure of sensitive information from adjacent memory regions. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5915 Upstream-patches: https://github.com/libarchive/libarchive/commit/a612bf62f86a6faa47bd57c52b94849f0a404d8c (From OE-Core rev: 41e7be4aa28481530d5e259d0f25b238b86c012d) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman