linux/poky.git/meta/recipes-extended/libarchive, branch scarthgap

libarchive: Fix CVE-2026-4424

2026-06-10T13:35:20+00:00

Pick patches from [1] and [2] as mentioned in Debian report in [3]. [1] https://github.com/libarchive/libarchive/commit/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375 [2] https://github.com/libarchive/libarchive/commit/e1907c5832b6489c7b4198b0825f857c93a03c10 [3] https://security-tracker.debian.org/tracker/CVE-2026-4424 (From OE-Core rev: 7fa280872275e194152cc2d355ad39c81a477d50) Signed-off-by: Hugo SIMELIERE (Schneider Electric) Reviewed-by: Bruno VERNAY Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: fix for CVE-2026-4426

2026-05-12T20:31:34+00:00

Pick patch from [1] also mentioned at Debian report in [2] [1] https://github.com/libarchive/libarchive/commit/c3cb1c568ebf9e8f7f478cfc0356ae54e99712b0 [2] https://security-tracker.debian.org/tracker/CVE-2026-4426 More details: https://nvd.nist.gov/vuln/detail/CVE-2026-4426 (From OE-Core rev: e4e78640b75acb474f82ca9e24be9a1d5b06740b) Signed-off-by: Hitendra Prajapati Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: Fix CVE-2026-4111

2026-05-04T12:57:30+00:00

Pick patch according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-4111 [2] https://github.com/libarchive/libarchive/pull/2877 [3] https://access.redhat.com/errata/RHSA-2026:5063 (From OE-Core rev: c938ecea4304a57edb824f121e0ca8f79b45bb7e) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

libarchive: fix CVE-2025-60753 regression

2026-01-26T09:45:39+00:00

Pick patch from PR mentioned in v3.8.5 release notes. (From OE-Core rev: c316c6e50e73a681c22fa03cdb59a0317495a418) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

libarchive: patch CVE-2025-60753

2025-12-01T15:34:55+00:00

Pick patch from [3] marked in [2] mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-60753 [2] https://github.com/libarchive/libarchive/issues/2725 [3] https://github.com/libarchive/libarchive/pull/2787 (From OE-Core rev: 1fbd9eddbdf0da062df0510cabff6f6ee33d5752) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch 3.8.3 security issue 2

2025-12-01T15:34:55+00:00

Pick patch [2] as listed in [1]. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2768 (From OE-Core rev: efe032eef7034009f1202985b2036fc79e06bddf) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch 3.8.3 security issue 1

2025-12-01T15:34:55+00:00

Pick patch [2] as listed in [1]. To apply it cleanly, add two additional patches from branch patch/3.8. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.3 [2] https://github.com/libarchive/libarchive/pull/2753 (From OE-Core rev: 11f782c1ae9962a2faa98bff3566e49fbf6db017) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: patch regression of patch for CVE-2025-5918

2025-09-01T15:30:56+00:00

Picked commit per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-5918 (From OE-Core rev: d2b8d2f7d579779a9effcff677960dbc576b1cc8) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: fix CVE-2025-5918

2025-07-09T15:43:32+00:00

A vulnerability has been identified in the libarchive library. This flaw can be triggered whe n file streams are piped into bsdtar, potentially allowing for reading past the end of the fi le. This out-of-bounds read can lead to unintended consequences, including unpredictable prog ram behavior, memory corruption, or a denial-of-service condition. CVE-2025-5918-0001 is the dependent commit and CVE-2025-5918-0002 is the actual CVE fix. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5918 Upstream-patches: https://github.com/libarchive/libarchive/commit/89b8c35ff4b5addc08a85bf5df02b407f8af1f6c https://github.com/libarchive/libarchive/commit/dcbf1e0ededa95849f098d154a25876ed5754bcf (From OE-Core rev: 369c164a163b2c7f15ee5fc41130be9feaf7245e) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

libarchive: fix CVE-2025-5917

2025-07-09T15:43:32+00:00

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by- one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1- byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, lea ding to unpredictable program behavior, crashes, or in specific circumstances, could be lever aged as a building block for more sophisticated exploitation. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5917 Upstream-patch: https://github.com/libarchive/libarchive/commit/7c02cde37a63580cd1859183fbbd2cf04a89be85 (From OE-Core rev: 2b6832b05bab414df1da7c74a0c6a5e5a9d75b29) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman