libarchive - Debian Package Tracker

general

source: libarchive (main)
version: 3.8.9-1
maintainer: Gabriel Barrantes (DMD)
uploaders: Syed Shahrukh Hussain [DMD] [DM]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.4.3-2+deb11u1
o-o-sec: 3.4.3-2+deb11u4
oldstable: 3.6.2-1+deb12u4
old-sec: 3.6.2-1+deb12u2
stable: 3.7.4-4+deb13u1
testing: 3.8.9-1
unstable: 3.8.9-1

versioned links

3.4.3-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.3-2+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.2-1+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.2-1+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.7.4-4+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.8.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libarchive-dev
libarchive-tools (1 bugs: 0, 1, 0, 0)
libarchive13t64 (1 bugs: 0, 0, 1, 0)

action needed

3 security issues in trixie high

There are 3 open security issues in trixie.

1 important issue:

CVE-2026-16517: A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

2 issues left for the package maintainer to handle:

CVE-2026-14164: (needs triaging) A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
CVE-2026-15028: (needs triaging) A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-06-30 Last update: 2026-08-08 18:30

3 security issues in bullseye high

There are 3 open security issues in bullseye.

2 important issues:

CVE-2026-15028: A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
CVE-2026-16517: A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

1 issue postponed or untriaged:

CVE-2026-14164: (postponed; to be fixed through a stable update) A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

Created: 2026-07-20 Last update: 2026-08-08 18:30

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2026-15028: A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
CVE-2026-16517: A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

1 issue postponed or untriaged:

CVE-2026-14164: (postponed; to be fixed through a stable update) A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

Created: 2026-06-30 Last update: 2026-08-08 18:30

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit e6f5609d03d45e663d4903e4e15b238599b6da44
Author: Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>
Date:   Sat Aug 1 16:44:01 2026 -0600

    debian/tests/control: replace pkg-config with pkgconf
    
    pkg-config is obsolete and has been replaced by pkgconf.

https://salsa.debian.org/api/v4/projects/debian%2Flibarchive API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-01 Last update: 2026-08-08 21:47

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-08-15 Last update: 2026-08-01 14:32

news

[rss feed]

[2026-08-08] libarchive 3.8.9-1 MIGRATED to testing (Debian testing watch)
[2026-08-01] Accepted libarchive 3.8.9-1 (source) into unstable (Syed Shahrukh Hussain)
[2026-07-13] libarchive 3.8.8-2 MIGRATED to testing (Debian testing watch)
[2026-07-11] Accepted libarchive 3.8.8-2 (source) into unstable (Gabriel Barrantes) (signed by: Luca Boccassi)
[2026-07-07] libarchive 3.8.8-1 MIGRATED to testing (Debian testing watch)
[2026-07-03] Accepted libarchive 3.8.8-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-05-06] Accepted libarchive 3.6.2-1+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-05-06] Accepted libarchive 3.7.4-4+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-05-05] Accepted libarchive 3.4.3-2+deb11u4 (source) into oldoldstable-security (Arnaud Rebillout)
[2026-04-24] libarchive 3.8.7-1 MIGRATED to testing (Debian testing watch)
[2026-04-20] Accepted libarchive 3.8.7-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-04-19] Accepted libarchive 3.8.6-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-01-22] libarchive 3.8.5-1 MIGRATED to testing (Debian testing watch)
[2026-01-11] Accepted libarchive 3.8.5-1 (source) into unstable (Gabriel Barrantes) (signed by: Antoine Le Gonidec)
[2026-01-08] Accepted libarchive 3.8.4-1 (source) into unstable (Antoine Le Gonidec)
[2025-11-11] Accepted libarchive 3.4.3-2+deb11u3 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-08-27] Accepted libarchive 3.6.2-1+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-07-30] libarchive 3.7.4-4 MIGRATED to testing (Debian testing watch)
[2025-07-26] Accepted libarchive 3.7.4-4 (source) into unstable (Peter Pentchev)
[2025-05-08] libarchive 3.7.4-3 MIGRATED to testing (Debian testing watch)
[2025-04-27] Accepted libarchive 3.7.4-3 (source) into unstable (Peter Pentchev)
[2025-04-26] Accepted libarchive 3.7.4-2 (source) into unstable (Peter Pentchev)
[2024-11-11] Accepted libarchive 3.4.3-2+deb11u2 (source) into oldstable-security (Adrian Bunk)
[2024-11-11] Accepted libarchive 3.6.2-1+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-10] libarchive 3.7.4-1.1 MIGRATED to testing (Debian testing watch)
[2024-11-09] Accepted libarchive 3.6.2-1+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-03] Accepted libarchive 3.7.4-1.1 (source) into unstable (Salvatore Bonaccorso)
[2024-08-09] libarchive 3.7.4-1 MIGRATED to testing (Debian testing watch)
[2024-08-07] Accepted libarchive 3.7.4-1 (source) into unstable (Peter Pentchev)
[2024-06-09] Accepted libarchive 3.6.2-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)

bugs [bug history graph]

all: 5
RC: 0
I&N: 4
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.8.7-1