libarchive - Debian Package Tracker

general

source: libarchive (main)
version: 3.6.0-1
maintainer: Peter Pentchev (DMD)
arch: any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.2.2-2+deb9u2
o-o-sec: 3.2.2-2+deb9u3
o-o-bpo-sl: 3.4.0-2~bpo9+1
oldstable: 3.3.3-4+deb10u1
old-sec: 3.3.3-4+deb10u2
stable: 3.4.3-2+deb11u1
testing: 3.6.0-1
unstable: 3.6.0-1

versioned links

3.2.2-2+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.2-2+deb9u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.3-4+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.3-4+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.0-2~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.3-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libarchive-dev
libarchive-tools
libarchive13

action needed

A new upstream version is available: 3.6.1 high

A new upstream version 3.6.1 is available, you should consider packaging it.

Created: 2022-04-11 Last update: 2022-12-08 09:38

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2022-26280: Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
CVE-2022-36227: In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

Created: 2022-07-04 Last update: 2022-12-02 12:37

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2022-26280: Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
CVE-2022-36227: In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

Created: 2022-07-04 Last update: 2022-12-02 12:37

3 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 60ac3a8909ee42deda04f10fbdf97376e746187a
Merge: 9640fbba dca50015
Author: Jelmer Vernooĳ <jelmer@debian.org>
Date:   Tue Nov 1 16:06:06 2022 +0000

    Merge branch 'lintian-fixes' into 'master'
    
    Fix some issues reported by lintian
    
    See merge request debian/libarchive!2

commit dca50015b69292973ca9de1c105b386feb948b16
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Oct 11 23:55:13 2021 +0000

    Update standards version to 4.6.0, no changes needed.
    
    Changes-By: lintian-brush
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

commit 41b8f6fb7a166ecccab77e9067854a372d5e5884
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Oct 11 23:55:02 2021 +0000

    Set upstream metadata fields: Bug-Database.
    
    Changes-By: lintian-brush
    Fixes: lintian: upstream-metadata-missing-bug-tracking
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html

Created: 2022-11-01 Last update: 2022-12-01 03:30

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-09-21 Last update: 2022-07-30 12:14

3 low-priority security issues in bullseye low

There are 3 open security issues in bullseye.

3 issues left for the package maintainer to handle:

CVE-2021-36976: (needs triaging) libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
CVE-2022-26280: (needs triaging) Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
CVE-2022-36227: (needs triaging) In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

You can find information about how to handle these issues in the security team's documentation.

Created: 2022-07-04 Last update: 2022-12-02 12:37

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.6.0).

Created: 2022-05-11 Last update: 2022-05-11 23:24

news

[rss feed]

[2022-11-22] Accepted libarchive 3.3.3-4+deb10u2 (source) into oldstable (Sylvain Beucler)
[2022-04-30] Accepted libarchive 3.2.2-2+deb9u3 (source all amd64) into oldoldstable (Thorsten Alteholz)
[2022-04-02] libarchive 3.6.0-1 MIGRATED to testing (Debian testing watch)
[2022-03-30] Accepted libarchive 3.6.0-1 (source) into unstable (Peter Pentchev)
[2022-03-05] Accepted libarchive 3.4.3-2+deb11u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Peter Pentchev)
[2021-12-25] libarchive 3.5.2-1 MIGRATED to testing (Debian testing watch)
[2021-12-22] Accepted libarchive 3.5.2-1 (source) into unstable (Peter Pentchev)
[2020-08-04] libarchive 3.4.3-2 MIGRATED to testing (Debian testing watch)
[2020-08-01] Accepted libarchive 3.4.3-2 (source) into unstable (Peter Pentchev)
[2020-06-06] libarchive 3.4.3-1 MIGRATED to testing (Debian testing watch)
[2020-06-03] Accepted libarchive 3.4.3-1 (source) into unstable (Peter Pentchev)
[2020-05-12] libarchive 3.4.2-1 MIGRATED to testing (Debian testing watch)
[2020-05-09] Accepted libarchive 3.4.2-1 (source) into unstable (Peter Pentchev)
[2020-03-20] Accepted libarchive 3.4.0-2~bpo9+1 (source amd64) into stretch-backports-sloppy->backports-policy, stretch-backports-sloppy (Debian FTP Masters) (signed by: Andreas Tille)
[2020-03-10] libarchive 3.4.0-2 MIGRATED to testing (Debian testing watch)
[2020-03-07] Accepted libarchive 3.4.0-2 (source) into unstable (Peter Pentchev)
[2019-11-01] Accepted libarchive 3.3.3-4+deb10u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Thorsten Alteholz)
[2019-11-01] Accepted libarchive 3.2.2-2+deb9u2 (source all amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Thorsten Alteholz)
[2019-10-31] Accepted libarchive 3.2.2-2+deb9u2 (source all amd64) into oldstable->embargoed, oldstable (Thorsten Alteholz)
[2019-10-31] Accepted libarchive 3.3.3-4+deb10u1 (source all amd64) into stable->embargoed, stable (Thorsten Alteholz)
[2019-10-26] Accepted libarchive 3.1.2-11+deb8u8 (source amd64) into oldoldstable (Thorsten Alteholz)
[2019-09-23] libarchive 3.4.0-1 MIGRATED to testing (Debian testing watch)
[2019-09-20] Accepted libarchive 3.4.0-1 (source) into unstable (Peter Pentchev)
[2019-02-08] libarchive 3.3.3-4 MIGRATED to testing (Debian testing watch)
[2019-02-07] Accepted libarchive 3.1.2-11+deb8u7 (source amd64) into oldstable (Antoine Beaupré)
[2019-02-06] Accepted libarchive 3.3.3-4 (source) into unstable (Peter Pentchev)
[2019-01-08] libarchive 3.3.3-3 MIGRATED to testing (Debian testing watch)
[2019-01-05] Accepted libarchive 3.3.3-3 (source) into unstable (Peter Pentchev)
[2018-12-30] Accepted libarchive 3.2.2-2+deb9u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Markus Koschany)
[2018-12-27] Accepted libarchive 3.2.2-2+deb9u1 (source all amd64) into stable->embargoed, stable (Markus Koschany)

bugs [bug history graph]

all: 9
RC: 0
I&N: 6
M&W: 3
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.6.0-1ubuntu1
4 bugs
patches for 3.6.0-1ubuntu1