Debian Package Tracker

general

source: libarchive (main)
version: 3.2.2-5
maintainer: Peter Pentchev [DMD]
arch: all any
std-ver: 4.2.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.0.4-3+wheezy1
o-o-sec: 3.0.4-3+wheezy6+deb7u1
o-o-bpo: 3.1.2-11+deb8u3~bpo70+1
oldstable: 3.1.2-11+deb8u3
old-sec: 3.1.2-11+deb8u3
stable: 3.2.2-2
testing: 3.2.2-5
unstable: 3.2.2-5

versioned links

3.0.4-3+wheezy1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.0.4-3+wheezy6+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2-8~bpo70+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2-11+deb8u3~bpo70+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.2-11+deb8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.2-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

bsdcpio
bsdtar
libarchive-dev
libarchive-tools
libarchive13

action needed

A new upstream version is available: 3.3.3 high

A new upstream version 3.3.3 is available, you should consider packaging it.

Created: 2017-11-21 Last update: 2018-09-24 02:39

lintian reports 6 warnings high

Lintian reports 6 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-03-06 Last update: 2018-06-01 07:48

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2017-11-21 Last update: 2018-09-24 07:39

2 new commits since last upload, time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.2.2-6, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit e2d10deaf2e92e3176e7d1c1b28ba9d1c9924444
Author: Peter Pentchev <roam@debian.org>
Date:   Sun Aug 26 15:50:22 2018 +0300

    Drop the debhelper-compat overrides, fixed in Lintian 2.5.98.

commit fff1f8208b4d57f5efe7692573eec78200019e69
Author: Peter Pentchev <roam@debian.org>
Date:   Sun Aug 26 15:46:06 2018 +0300

    Policy 4.2.1, no changes.

Created: 2018-08-25 Last update: 2018-09-23 14:13

7 ignored security issues in stretch low

There are 7 open security issues in stretch.

7 issues skipped by the security teams:

CVE-2017-14503: libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16.
CVE-2016-10349: The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
CVE-2017-14501: An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header.
CVE-2017-14502: read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.
CVE-2017-14166: libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.
CVE-2016-10209: The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.
CVE-2016-10350: The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.

Please fix them.

Created: 2017-03-20 Last update: 2018-08-28 08:42

12 ignored security issues in jessie low

There are 12 open security issues in jessie.

12 issues skipped by the security teams:

CVE-2017-14503: libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c when extracting a specially crafted lha archive, related to lha_crc16.
CVE-2016-10349: The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
CVE-2016-8689: The read_Header function in archive_read_support_format_7zip.c in libarchive 3.2.1 allows remote attackers to cause a denial of service (out-of-bounds read) via multiple EmptyStream attributes in a header in a 7zip archive.
CVE-2017-14501: An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when extracting a specially crafted iso9660 iso file, related to archive_read_format_iso9660_read_header.
CVE-2017-14502: read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.
CVE-2017-14166: libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.
CVE-2016-10209: The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.
CVE-2016-10350: The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file.
CVE-2017-5601: An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.
CVE-2016-8688: The mtree bidder in libarchive 3.2.1 does not keep track of line sizes when extending the read-ahead, which allows remote attackers to cause a denial of service (crash) via a crafted file, which triggers an invalid read in the (1) detect_form or (2) bid_entry function in libarchive/archive_read_support_format_mtree.c.
CVE-2016-8687: Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
CVE-2015-8915: bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.

Please fix them.

Created: 2015-07-12 Last update: 2018-08-28 08:42

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 4.2.0).

Created: 2018-08-26 Last update: 2018-08-26 08:17

news

[rss feed]

[2018-08-28] libarchive 3.2.2-5 MIGRATED to testing (Debian testing watch)
[2018-08-28] libarchive 3.2.2-5 MIGRATED to testing (Debian testing watch)
[2018-08-25] Accepted libarchive 3.2.2-5 (source) into unstable (Peter Pentchev)
[2018-08-17] libarchive 3.2.2-4.2 MIGRATED to testing (Debian testing watch)
[2018-08-15] Accepted libarchive 3.2.2-4.2 (source) into unstable (Salvatore Bonaccorso)
[2018-07-28] libarchive 3.2.2-4.1 MIGRATED to testing (Debian testing watch)
[2018-07-25] Accepted libarchive 3.2.2-4.1 (source) into unstable (Salvatore Bonaccorso)
[2018-06-02] libarchive 3.2.2-4 MIGRATED to testing (Debian testing watch)
[2018-05-30] Accepted libarchive 3.2.2-4 (source) into unstable (Andreas Henriksson)
[2017-09-17] libarchive 3.2.2-3.1 MIGRATED to testing (Debian testing watch)
[2017-09-14] Accepted libarchive 3.2.2-3.1 (source) into unstable (Salvatore Bonaccorso)
[2017-09-14] Accepted libarchive 3.2.2-3 (source) into unstable (Andreas Henriksson)
[2017-09-14] Accepted libarchive 3.2.2-2.1 (source) into unstable (Salvatore Bonaccorso)
[2017-09-08] Accepted libarchive 3.0.4-3+wheezy6+deb7u1 (source amd64) into oldoldstable (Chris Lamb)
[2017-06-30] Accepted libarchive 3.0.4-3+wheezy6 (source amd64) into oldoldstable (Raphaël Hertzog)
[2017-04-09] libarchive 3.2.2-2 MIGRATED to testing (Debian testing watch)
[2017-04-04] Accepted libarchive 3.1.2-11+deb8u3~bpo70+1 (source amd64) into wheezy-backports->backports-policy, wheezy-backports (Paul Wise)
[2017-04-03] Accepted libarchive 3.2.2-2 (source) into unstable (Andreas Henriksson)
[2017-04-03] Accepted libarchive 3.2.2-1 (source) into unstable (Andreas Henriksson)
[2017-02-03] libarchive 3.2.1-6 MIGRATED to testing (Debian testing watch)
[2017-01-31] Accepted libarchive 3.2.1-6 (source) into unstable (Andreas Henriksson)
[2017-01-31] Accepted libarchive 3.0.4-3+wheezy5+deb7u1 (source amd64) into oldstable (Chris Lamb)
[2016-10-24] libarchive 3.2.1-5 MIGRATED to testing (Debian testing watch)
[2016-10-17] Accepted libarchive 3.0.4-3+wheezy5 (source amd64) into oldstable (Jonas Meurer)
[2016-10-16] Accepted libarchive 3.2.1-5 (source) into unstable (Andreas Henriksson)
[2016-10-16] libarchive 3.2.1-4 MIGRATED to testing (Debian testing watch)
[2016-10-15] Accepted libarchive 3.0.4-3+wheezy4 (source amd64) into oldstable (Emilio Pozuelo Monfort)
[2016-10-06] Accepted libarchive 3.2.1-4 (source) into unstable (Andreas Henriksson)
[2016-10-06] Accepted libarchive 3.2.1-3 (source all amd64) into unstable (Andreas Henriksson)
[2016-10-03] Accepted libarchive 3.1.2-11+deb8u3 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)

bugs [bug history graph]

all: 11
RC: 0
I&N: 6
M&W: 3
F&P: 0
patch: 2

links

homepage
lintian (0, 6)
buildd: logs, clang, reproducibility
popcon
debci
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.2.2-5
4 bugs