linux/poky.git/meta/recipes-extended/libarchive/libarchive_3.6.2.bb, branch yocto-4.0.29

libarchive: fix CVE-2025-5917

2025-07-14T15:37:40+00:00

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by- one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1- byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, lea ding to unpredictable program behavior, crashes, or in specific circumstances, could be lever aged as a building block for more sophisticated exploitation. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5917 Upstream-patch: https://github.com/libarchive/libarchive/commit/7c02cde37a63580cd1859183fbbd2cf04a89be85 (From OE-Core rev: 2b2a2fce345c9bfcad44cc8ef3419f43dd07b022) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libarchive: fix CVE-2025-5916

2025-07-14T15:37:40+00:00

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5916 Upstream-patch: https://github.com/libarchive/libarchive/commit/ef093729521fcf73fa4007d5ae77adfe4df42403 (From OE-Core rev: 0e939bf5fc7412c7357fcd7d8ae760f023ac40eb) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libarchive: fix CVE-2025-5915

2025-07-14T15:37:40+00:00

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap b uffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer -Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memo ry buffer, which can result in unpredictable program behavior, crashes (denial of service), o r the disclosure of sensitive information from adjacent memory regions. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5915 Upstream-patches: https://github.com/libarchive/libarchive/commit/a612bf62f86a6faa47bd57c52b94849f0a404d8c (From OE-Core rev: 41e7be4aa28481530d5e259d0f25b238b86c012d) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libarchive: Fix CVE-2025-5914

2025-07-09T15:23:23+00:00

Adds patch to backport fix for CVE-2025-5914. (From OE-Core rev: 4a4c6e0382834e03480e07f30ed5efa23f6c6fe2) Signed-off-by: Colin Pinnell McAllister Signed-off-by: Steve Sakoman

libarchive: ignore CVE-2024-48615

2025-05-02T15:12:41+00:00

Fix for this CVE [1] is patchong code introduced by [2] in v3.7.5. So v3.6.2 is not affected yet and the CVE can be safely ignored. Also Debian tracker [3] contains this statement. [1] https://github.com/libarchive/libarchive/commit/565b5aea491671ae33df1ca63697c10d54c00165 [2] https://github.com/libarchive/libarchive/commit/2d8a5760c5ec553283a95a1aaca746f6eb472d0f [3] https://security-tracker.debian.org/tracker/CVE-2024-48615 (From OE-Core rev: 60390a3a28242efba32360426b0a3be6af5fb54b) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: ignore CVE-2025-1632

2025-04-04T15:42:47+00:00

As already mentioned in [1] when backporting commit including fix for this CVE, this vulnerability applies only from libarchive 3.7.0 commit [2] which introduced bsdunzip which contains this vulnerability. [1] https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=ec837d3b21b4f8b98abac53e2833f1490ba6bf1e [2] https://github.com/libarchive/libarchive/commit/c157e4ce8eb170a92945cc2d292fd7106bdfcce1 (From OE-Core rev: bf7654877ba99f0b18a1cf6f83032af5ecabd01f) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch CVE-2025-25724

2025-03-19T14:13:17+00:00

Pick commit referencing this MR which was merged to master. Note that this commit also patched CVE-2025-1632 in bsdunzip, however that utility was introduced only in 3.7.0, so that part is not applicable in kirkstone. (From OE-Core rev: ec837d3b21b4f8b98abac53e2833f1490ba6bf1e) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: Fix CVE-2024-20696

2025-01-09T16:41:03+00:00

Add Patch file to fix CVE-2024-20696 CVE: CVE-2024-20696 (From OE-Core rev: 8885aa23d77fcec288a416d199e08c6eee27e027) Signed-off-by: Nitin Wankhade Signed-off-by: Nikhil R Signed-off-by: Steve Sakoman

libarchive: Fix CVE-2024-48957 & CVE-2024-48958

2024-10-24T13:31:58+00:00

Backport fix: * CVE-2024-48957 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/3006bc5d02ad3ae3c4f9274f60c1f9d2d834734b * CVE-2024-48958 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/a1cb648d52f5b6d3f31184d9b6a7cbca628459b7 (From OE-Core rev: 584ce77f3aae332c66e2140497506301200ec9ca) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

libarchive: ignore CVE-2024-37407

2024-07-24T14:51:58+00:00

History of code changes: * introduced: https://github.com/ilibarchive/libarchive/commit/390d83012fdba8c8db7fc9915338805882b0597a (v3.7.2-52-g390d8301) * reverted: 6https://github.com/libarchive/libarchive/commit/2c8caf6611a7d0662d80176c4fdb40f85794699 (v3.7.2-53-g62c8caf6) * re-introduced: 9https://github.com/libarchive/libarchive/commit/1f27004a5c88589658e38d68e46d223da6b75ca (v3.7.3-14-g91f27004) * fixed: bhttps://github.com/libarchive/libarchive/commit/6a979481b7d77c12fa17bbed94576b63bbcb0c0 (v3.7.3-24-gb6a97948) Since there is no release where this CVE was present, we can safely ignore it. (From OE-Core rev: 2b407f34df5a768c271fc7049e7272d1a79c04a0) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman