UbuntuUpdates.org

Package "libarchive"

Name: libarchive

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • FreeBSD implementations of 'tar' and 'cpio' and other archive tools
Latest version: 3.8.5-1ubuntu2.3
Release: resolute (26.04)
Level: updates
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "libarchive" in Resolute

Repository Area Version
base main 3.8.5-1ubuntu2
base universe 3.8.5-1ubuntu2
security main 3.8.5-1ubuntu2.3
security universe 3.8.5-1ubuntu2.3
updates main 3.8.5-1ubuntu2.3

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 3.8.5-1ubuntu2.3 2026-10-08 18:07:30 UTC

libarchive (3.8.5-1ubuntu2.3) resolute-security; urgency=medium

  * SECURITY UPDATE: integer overflow in ZIP writer
    - debian/patches/CVE-2026-16517.patch: Merge pull request #3228 from
      datauwu/zip-encrypted-int-overflow in
      libarchive/archive_write_set_format_zip.c.
    - CVE-2026-16517

 -- Marc Deslauriers Wed, 07 Oct 2026 09:39:05 -0400
Source diff to previous version
CVE-2026-16517 A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zi

Version: 3.8.5-1ubuntu2.2 2026-07-21 20:08:26 UTC
No changelog available yet.
Source diff to previous version

Version: 3.8.5-1ubuntu2.1 2026-05-21 19:07:37 UTC

  libarchive (3.8.5-1ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Heap out-of-bounds read during RAR archive processing
    - debian/patches/CVE-2026-4424-1.patch: Reallocate undersized LZSS windows
      in libarchive/archive_read_support_format_rar.c
    - debian/patches/CVE-2026-4424-2.patch: Cast LZSS mask comparison in
      libarchive/archive_read_support_format_rar.c
    - CVE-2026-4424
  * SECURITY UPDATE: Undefined behavior during zisofs decompression
    - debian/patches/CVE-2026-4426.patch: Validate zisofs block size exponent
      in libarchive/archive_read_support_format_iso9660.c
    - CVE-2026-4426
  * SECURITY UPDATE: Integer overflow during zisofs block pointer allocation
    - debian/patches/CVE-2026-5121.patch: Add related regression tests in
      test/test_read_format_iso_zisofs_overflow.c and
      ../test_read_format_iso_zisofs_overflow.iso.uu
    - CVE-2026-5121

 -- Shafayat Hossain Majumder <email address hidden> Tue, 20 May 2026 11:52:49 -0400
CVE-2026-4424 A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of t
CVE-2026-4426 A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a fiel
CVE-2026-5121 A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote at


About   -   Send Feedback to @ubuntu_updates