UbuntuUpdates.org

Package "libarchive-tools"

Name: libarchive-tools

Description:

FreeBSD implementations of 'tar' and 'cpio' and other archive tools
Latest version: 3.8.5-1ubuntu2.3
Release: resolute (26.04)
Level: security
Repository: universe
Head package: libarchive
Homepage: https://www.libarchive.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libarchive-tools"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libarchive-tools" in Resolute

Repository Area Version
base universe 3.8.5-1ubuntu2
updates universe 3.8.5-1ubuntu2.3

Changelog

Version: 3.8.5-1ubuntu2.3 2026-10-08 15:07:47 UTC

libarchive (3.8.5-1ubuntu2.3) resolute-security; urgency=medium

  * SECURITY UPDATE: integer overflow in ZIP writer
    - debian/patches/CVE-2026-16517.patch: Merge pull request #3228 from
      datauwu/zip-encrypted-int-overflow in
      libarchive/archive_write_set_format_zip.c.
    - CVE-2026-16517

 -- Marc Deslauriers Wed, 07 Oct 2026 09:39:05 -0400
Source diff to previous version
CVE-2026-16517 A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zi

Version: 3.8.5-1ubuntu2.2 2026-07-21 18:08:16 UTC
No changelog available yet.
Source diff to previous version

Version: 3.8.5-1ubuntu2.1 2026-05-21 17:07:38 UTC

  libarchive (3.8.5-1ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap out-of-bounds read during RAR archive processing
    - debian/patches/CVE-2026-4424-1.patch: Reallocate undersized LZSS windows
      in libarchive/archive_read_support_format_rar.c
    - debian/patches/CVE-2026-4424-2.patch: Cast LZSS mask comparison in
      libarchive/archive_read_support_format_rar.c
    - CVE-2026-4424
  * SECURITY UPDATE: Undefined behavior during zisofs decompression
    - debian/patches/CVE-2026-4426.patch: Validate zisofs block size exponent
      in libarchive/archive_read_support_format_iso9660.c
    - CVE-2026-4426
  * SECURITY UPDATE: Integer overflow during zisofs block pointer allocation
    - debian/patches/CVE-2026-5121.patch: Add related regression tests in
      test/test_read_format_iso_zisofs_overflow.c and
      ../test_read_format_iso_zisofs_overflow.iso.uu
    - CVE-2026-5121

 -- Shafayat Hossain Majumder <email address hidden> Tue, 20 May 2026 11:52:49 -0400
CVE-2026-4424 A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of t
CVE-2026-4426 A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a fiel
CVE-2026-5121 A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote at


About   -   Send Feedback to @ubuntu_updates