libarchive - Debian Package Tracker

general

source: libarchive (main)
version: 3.8.9-1
maintainer: Gabriel Barrantes (DMD)
uploaders: Syed Shahrukh Hussain [DMD] [DM]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.4.3-2+deb11u1
o-o-sec: 3.4.3-2+deb11u5
oldstable: 3.6.2-1+deb12u4
old-sec: 3.6.2-1+deb12u5
stable: 3.7.4-4+deb13u1
testing: 3.8.9-1
unstable: 3.8.9-1

versioned links

3.4.3-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.3-2+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.2-1+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.2-1+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.7.4-4+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.8.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libarchive-dev
libarchive-tools (1 bugs: 0, 1, 0, 0)
libarchive13t64 (1 bugs: 0, 0, 1, 0)

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://api.github.com/repos/libarchive/libarchive/releases?per_page=100 failed: 500 Can't connect to api.github.com:443 (Temporary failure in name resolution)

Created: 2026-10-17 Last update: 2026-10-21 08:00

4 security issues in trixie high

There are 4 open security issues in trixie.

1 important issue:

CVE-2026-17591: A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

3 issues left for the package maintainer to handle:

CVE-2026-14164: (needs triaging) A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
CVE-2026-15028: (needs triaging) A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
CVE-2026-16517: (needs triaging) A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-06-30 Last update: 2026-10-17 11:48

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-17591: A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

Created: 2026-10-17 Last update: 2026-10-17 11:48

3 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 4be6d0ffe47c451a989f05879da302ee554443e6
Merge: e6f5609 91ca6d3
Author: Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>
Date:   Fri Oct 16 18:56:48 2026 +0000

    Update upstream source from tag 'upstream/3.8.10'
    
    Update to upstream version '3.8.10'
    with Debian dir c0775c91ae25d3f9cf1e7775df5afcf154c82a0b

commit 91ca6d333cf9f083b8f31e84bc714f19f468237e
Author: Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>
Date:   Fri Oct 16 18:55:57 2026 +0000

    New upstream version 3.8.10

commit e6f5609d03d45e663d4903e4e15b238599b6da44
Author: Gabriel Barrantes <gabriel.barrantes.dev@outlook.com>
Date:   Sat Aug 1 16:44:01 2026 -0600

    debian/tests/control: replace pkg-config with pkgconf
    
    pkg-config is obsolete and has been replaced by pkgconf.

Created: 2026-08-01 Last update: 2026-10-19 00:00

2 open merge requests in Salsa normal

There are 2 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-09-30 Last update: 2026-10-18 15:00

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-08-15 Last update: 2026-08-01 14:32

news

[rss feed]

[2026-08-31] Accepted libarchive 3.4.3-2+deb11u5 (source) into oldoldstable-security (Abhijith PA)
[2026-08-31] Accepted libarchive 3.6.2-1+deb12u5 (source) into oldstable-security (Abhijith PA)
[2026-08-08] libarchive 3.8.9-1 MIGRATED to testing (Debian testing watch)
[2026-08-01] Accepted libarchive 3.8.9-1 (source) into unstable (Syed Shahrukh Hussain)
[2026-07-13] libarchive 3.8.8-2 MIGRATED to testing (Debian testing watch)
[2026-07-11] Accepted libarchive 3.8.8-2 (source) into unstable (Gabriel Barrantes) (signed by: Luca Boccassi)
[2026-07-07] libarchive 3.8.8-1 MIGRATED to testing (Debian testing watch)
[2026-07-03] Accepted libarchive 3.8.8-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-05-06] Accepted libarchive 3.6.2-1+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-05-06] Accepted libarchive 3.7.4-4+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-05-05] Accepted libarchive 3.4.3-2+deb11u4 (source) into oldoldstable-security (Arnaud Rebillout)
[2026-04-24] libarchive 3.8.7-1 MIGRATED to testing (Debian testing watch)
[2026-04-20] Accepted libarchive 3.8.7-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-04-19] Accepted libarchive 3.8.6-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-01-22] libarchive 3.8.5-1 MIGRATED to testing (Debian testing watch)
[2026-01-11] Accepted libarchive 3.8.5-1 (source) into unstable (Gabriel Barrantes) (signed by: Antoine Le Gonidec)
[2026-01-08] Accepted libarchive 3.8.4-1 (source) into unstable (Antoine Le Gonidec)
[2025-11-11] Accepted libarchive 3.4.3-2+deb11u3 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-08-27] Accepted libarchive 3.6.2-1+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-07-30] libarchive 3.7.4-4 MIGRATED to testing (Debian testing watch)
[2025-07-26] Accepted libarchive 3.7.4-4 (source) into unstable (Peter Pentchev)
[2025-05-08] libarchive 3.7.4-3 MIGRATED to testing (Debian testing watch)
[2025-04-27] Accepted libarchive 3.7.4-3 (source) into unstable (Peter Pentchev)
[2025-04-26] Accepted libarchive 3.7.4-2 (source) into unstable (Peter Pentchev)
[2024-11-11] Accepted libarchive 3.4.3-2+deb11u2 (source) into oldstable-security (Adrian Bunk)
[2024-11-11] Accepted libarchive 3.6.2-1+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-10] libarchive 3.7.4-1.1 MIGRATED to testing (Debian testing watch)
[2024-11-09] Accepted libarchive 3.6.2-1+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-03] Accepted libarchive 3.7.4-1.1 (source) into unstable (Salvatore Bonaccorso)
[2024-08-09] libarchive 3.7.4-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 5
RC: 0
I&N: 4
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.8.9-1
3 bugs