libarchive - Debian Package Tracker

general

source: libarchive (main)
version: 3.7.4-1.1
maintainer: Peter Pentchev (DMD)
arch: any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.3.3-4+deb10u1
o-o-sec: 3.3.3-4+deb10u3
oldstable: 3.4.3-2+deb11u1
old-sec: 3.4.3-2+deb11u2
stable: 3.6.2-1+deb12u2
stable-sec: 3.6.2-1+deb12u2
testing: 3.7.4-1.1
unstable: 3.7.4-1.1

versioned links

3.3.3-4+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.3-4+deb10u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.3-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.3-2+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.2-1+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.7.4-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libarchive-dev
libarchive-tools (1 bugs: 0, 1, 0, 0)
libarchive13t64 (1 bugs: 0, 0, 1, 0)

action needed

A new upstream version is available: 3.7.7 high

A new upstream version 3.7.7 is available, you should consider packaging it.

Created: 2024-09-16 Last update: 2025-03-06 05:35

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2025-25724: list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Created: 2025-03-02 Last update: 2025-03-02 12:32

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2025-25724: list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Created: 2025-03-02 Last update: 2025-03-02 12:32

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2025-25724: list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Created: 2025-03-02 Last update: 2025-03-02 12:32

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2025-25724: list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Created: 2025-03-02 Last update: 2025-03-02 12:32

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.7.4-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit c71391aebd16d597dea69807e16d0747883e52f5
Author: Peter Pentchev <roam@debian.org>
Date:   Tue Feb 18 15:39:42 2025 +0200

    Update the changelog file

commit 25cfcf1d73b5c4019f223e7fa0e3d993ee1c3aaf
Author: Peter Pentchev <roam@debian.org>
Date:   Mon Feb 17 14:33:14 2025 +0200

    Let dh_auto_test handle parallel running by itself

commit e0c866f9786e8f208464c7e38a54a926577e99f2
Author: Peter Pentchev <roam@debian.org>
Date:   Mon Feb 17 14:32:51 2025 +0200

    No longer create the en_US.UTF-8 locale for the tests

commit 95d2b32958bfb87fae2aff655aac3f44f18334e3
Author: Peter Pentchev <roam@debian.org>
Date:   Mon Feb 17 14:26:24 2025 +0200

    Use the C.UTF-8 locale for testing

commit ea7a06e99985c40d0ae57a86a2c84760a6d9a593
Author: Peter Pentchev <roam@debian.org>
Date:   Tue Feb 18 12:21:05 2025 +0200

    Salsa CI: temporarily disable reprotest

commit a5f985c66875f378c02b7bcb94b00b6e25ac2931
Author: Peter Pentchev <roam@debian.org>
Date:   Tue Feb 18 12:06:08 2025 +0200

    Add the unzip-test-env patch to fix a test

commit 6e2659d47cd4f52bfc30493dee3de3488e3d1e3d
Author: Peter Pentchev <roam@debian.org>
Date:   Mon Feb 17 15:10:24 2025 +0200

    Dump the logfiles for failed tests

commit 9f707c3de2b4a96f3d9b6270ae851e5577e2b837
Author: Peter Pentchev <roam@debian.org>
Date:   Mon Feb 17 14:18:16 2025 +0200

    Use the now-canonical Salsa CI pipeline definition

commit 10767f759bf9a67dd862992475f1ece63b5dd8c5
Author: Peter Pentchev <roam@debian.org>
Date:   Mon Feb 17 14:06:53 2025 +0200

    Add the year 2025 to my debian/* copyright notice

commit 953b1fbbb8b50fb8b872cd5816c87bd1a953597c
Author: Peter Pentchev <roam@debian.org>
Date:   Mon Feb 17 14:03:50 2025 +0200

    Run the test suite by default
    
    To invert the check/nocheck DEB_BUILD_OPTIONS logic, it is enough to
    drop our check altogether, since we use a recent version of
    debhelper that checks for "nocheck" automatically before
    invoking the test target at all.
    
    That sentence was fun to write.
    
    Addresses: !7

Created: 2025-02-17 Last update: 2025-03-03 08:00

debian/patches: 2 patches to forward upstream low

Among the 4 debian patches available in version 3.7.4-1.1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-10-15 Last update: 2024-11-04 06:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.7.0).

Created: 2025-02-21 Last update: 2025-02-27 13:25

testing migrations

This package will soon be part of the auto-libxml2 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2024-11-11] Accepted libarchive 3.4.3-2+deb11u2 (source) into oldstable-security (Adrian Bunk)
[2024-11-11] Accepted libarchive 3.6.2-1+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-10] libarchive 3.7.4-1.1 MIGRATED to testing (Debian testing watch)
[2024-11-09] Accepted libarchive 3.6.2-1+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-03] Accepted libarchive 3.7.4-1.1 (source) into unstable (Salvatore Bonaccorso)
[2024-08-09] libarchive 3.7.4-1 MIGRATED to testing (Debian testing watch)
[2024-08-07] Accepted libarchive 3.7.4-1 (source) into unstable (Peter Pentchev)
[2024-06-09] Accepted libarchive 3.6.2-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-06-06] libarchive 3.7.2-2.1 MIGRATED to testing (Debian testing watch)
[2024-06-05] Accepted libarchive 3.6.2-1+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-06-03] Accepted libarchive 3.7.2-2.1 (source) into unstable (Salvatore Bonaccorso)
[2024-04-25] libarchive 3.7.2-2 MIGRATED to testing (Debian testing watch)
[2024-03-31] Accepted libarchive 3.7.2-2 (source) into unstable (Peter Pentchev)
[2024-02-29] Accepted libarchive 3.7.2-1.1 (source) into unstable (Lukas Märdian)
[2024-01-31] Accepted libarchive 3.7.2-1.1~exp1 (source) into experimental (Steve Langasek)
[2023-10-18] libarchive 3.7.2-1 MIGRATED to testing (Debian testing watch)
[2023-10-14] Accepted libarchive 3.7.2-1 (source) into unstable (Peter Pentchev)
[2023-01-30] Accepted libarchive 3.3.3-4+deb10u3 (source) into oldstable (Thorsten Alteholz)
[2022-12-27] libarchive 3.6.2-1 MIGRATED to testing (Debian testing watch)
[2022-12-27] libarchive 3.6.2-1 MIGRATED to testing (Debian testing watch)
[2022-12-24] Accepted libarchive 3.6.2-1 (source) into unstable (Peter Pentchev)
[2022-11-22] Accepted libarchive 3.3.3-4+deb10u2 (source) into oldstable (Sylvain Beucler)
[2022-04-30] Accepted libarchive 3.2.2-2+deb9u3 (source all amd64) into oldoldstable (Thorsten Alteholz)
[2022-04-02] libarchive 3.6.0-1 MIGRATED to testing (Debian testing watch)
[2022-03-30] Accepted libarchive 3.6.0-1 (source) into unstable (Peter Pentchev)
[2022-03-05] Accepted libarchive 3.4.3-2+deb11u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Peter Pentchev)
[2021-12-25] libarchive 3.5.2-1 MIGRATED to testing (Debian testing watch)
[2021-12-22] Accepted libarchive 3.5.2-1 (source) into unstable (Peter Pentchev)
[2020-08-04] libarchive 3.4.3-2 MIGRATED to testing (Debian testing watch)
[2020-08-01] Accepted libarchive 3.4.3-2 (source) into unstable (Peter Pentchev)

bugs [bug history graph]

all: 11
RC: 0
I&N: 6
M&W: 4
F&P: 1
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.7.7-0ubuntu2
4 bugs
patches for 3.7.7-0ubuntu2