libarchive - Debian Package Tracker

general

source: libarchive (main)
version: 3.8.10-1
maintainer: Gabriel Barrantes (DMD)
uploaders: Syed Shahrukh Hussain [DMD] [DM]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.4.3-2+deb11u1
o-o-sec: 3.4.3-2+deb11u5
oldstable: 3.6.2-1+deb12u4
old-sec: 3.6.2-1+deb12u5
stable: 3.7.4-4+deb13u1
testing: 3.8.9-1
unstable: 3.8.10-1

versioned links

3.4.3-2+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.3-2+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.2-1+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.6.2-1+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.7.4-4+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.8.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.8.10-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libarchive-dev
libarchive-tools (1 bugs: 0, 1, 0, 0)
libarchive13t64 (1 bugs: 0, 0, 1, 0)

action needed

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-09-30 Last update: 2026-10-26 13:33

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit aba784e9dc778e0793dd65dc086e7224df39a88a
Author: Johannes Schauer Marin Rodrigues <josch@debian.org>
Date:   Sun Oct 25 19:32:04 2026 +0100

    cherry-pick upstream patch from master branch, a fixup for a cherry-picked fix for a use-after-free bug
    
    Without this fix, empty tar archives as well as zip archives cannot be
    read. Reproducers:
    
        $ dd if=/dev/zero bs=10240 count=1 status=none | bsdtar tf -
        bsdtar: Truncated tar archive detected while reading next header
        bsdtar: Error exit delayed from previous errors
    
        $ cat test.zip | bsdtar tf -
        bsdtar: (null)
        bsdtar: Error exit delayed from previous errors
    
    Origin: https://github.com/libarchive/libarchive/pull/3650
    Link: https://github.com/libarchive/libarchive/pull/3394
    Link: https://github.com/libarchive/libarchive/pull/3768
    Bug: https://github.com/libarchive/libarchive/issues/3767
    Closes: #1152028

Created: 2026-10-26 Last update: 2026-10-26 13:33

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-08-15 Last update: 2026-08-01 14:32

4 low-priority security issues in trixie low

There are 4 open security issues in trixie.

4 issues left for the package maintainer to handle:

CVE-2026-14164: (needs triaging) A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
CVE-2026-15028: (needs triaging) A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.
CVE-2026-16517: (needs triaging) A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.
CVE-2026-17591: (needs triaging) A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-06-30 Last update: 2026-10-25 08:00

testing migrations

excuses:
- Migration status for libarchive (3.8.9-1 to 3.8.10-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating libarchive would introduce bugs in testing: #1152028
- ∙ ∙ Autopkgtest for archivemount/1c-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for avogadrolibs/2.0.0-6: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for cmake/4.3.4-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for deb-gview/0.3.8: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for debvm/0.5.5: amd64: Pass, arm64: Pass, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: Pass, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Pass
- ∙ ∙ Autopkgtest for diffoscope/334: amd64: Failed (not a regression) ♻ (reference ♻), arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Failed (not a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for evince-gtk3/48.4+dfsg-2: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for flatpak/1.18.4-1: amd64: Pass, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for font-manager/0.9.4-5: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻
- ∙ ∙ Autopkgtest for gimp/3.2.6-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for gnome-autoar/0.4.5-5: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for grub-customizer/5.2.8-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for hydrogen/1.2.7+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for libarchive/3.8.10-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for libextractor/1:1.19-2: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for libgepub/0.7.3-4: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for libticalcs/1.1.10~git20240415.7c4858d+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for libtifiles/1.1.8~git20240415.7c4858d-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for muon-meson/0.5.0-1.1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for nix/2.34.8+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for openqa/5.1790164836.5c04ab047-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Regression ♻ (reference ♻), s390x: Pass
- ∙ ∙ Autopkgtest for ostree/2026.4-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for papers/49.3-4: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: Test triggered, ppc64el: No tests, superficial or marked flaky ♻, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for python-libarchive-c/5.1-1: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), armhf: Regression ♻ (reference ♻), i386: Test triggered, ppc64el: Regression ♻ (reference ♻), riscv64: Reference test triggered, but real test failed already ♻, s390x: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for python-rarfile/4.5-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for reprepro/5.4.6+really5.3.2-3: amd64: Failed (not a regression) ♻ (reference ♻), arm64: Failed (not a regression) ♻ (reference ♻), armhf: Failed (not a regression) ♻ (reference ♻), i386: Test triggered, ppc64el: Failed (not a regression) ♻ (reference ♻), riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for rpm/6.1.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for samba/2:4.25.1+dfsg-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for swi-prolog/9.2.9+dfsg-1.1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for systemd/262-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for unrar-free/1:0.3.3-1: amd64: Pass, arm64: Pass, armhf: Failed (not a regression) ♻ (reference ♻), i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for vlc/3.0.24-4: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Too young, only 2 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/liba/libarchive.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-10-24] Accepted libarchive 3.8.10-1 (source) into unstable (Gabriel Barrantes) (signed by: Syed Shahrukh Hussain)
[2026-08-31] Accepted libarchive 3.4.3-2+deb11u5 (source) into oldoldstable-security (Abhijith PA)
[2026-08-31] Accepted libarchive 3.6.2-1+deb12u5 (source) into oldstable-security (Abhijith PA)
[2026-08-08] libarchive 3.8.9-1 MIGRATED to testing (Debian testing watch)
[2026-08-01] Accepted libarchive 3.8.9-1 (source) into unstable (Syed Shahrukh Hussain)
[2026-07-13] libarchive 3.8.8-2 MIGRATED to testing (Debian testing watch)
[2026-07-11] Accepted libarchive 3.8.8-2 (source) into unstable (Gabriel Barrantes) (signed by: Luca Boccassi)
[2026-07-07] libarchive 3.8.8-1 MIGRATED to testing (Debian testing watch)
[2026-07-03] Accepted libarchive 3.8.8-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-05-06] Accepted libarchive 3.6.2-1+deb12u4 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-05-06] Accepted libarchive 3.7.4-4+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Arnaud Rebillout)
[2026-05-05] Accepted libarchive 3.4.3-2+deb11u4 (source) into oldoldstable-security (Arnaud Rebillout)
[2026-04-24] libarchive 3.8.7-1 MIGRATED to testing (Debian testing watch)
[2026-04-20] Accepted libarchive 3.8.7-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-04-19] Accepted libarchive 3.8.6-1 (source) into unstable (Gabriel Barrantes) (signed by: bage@debian.org)
[2026-01-22] libarchive 3.8.5-1 MIGRATED to testing (Debian testing watch)
[2026-01-11] Accepted libarchive 3.8.5-1 (source) into unstable (Gabriel Barrantes) (signed by: Antoine Le Gonidec)
[2026-01-08] Accepted libarchive 3.8.4-1 (source) into unstable (Antoine Le Gonidec)
[2025-11-11] Accepted libarchive 3.4.3-2+deb11u3 (source) into oldoldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-08-27] Accepted libarchive 3.6.2-1+deb12u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2025-07-30] libarchive 3.7.4-4 MIGRATED to testing (Debian testing watch)
[2025-07-26] Accepted libarchive 3.7.4-4 (source) into unstable (Peter Pentchev)
[2025-05-08] libarchive 3.7.4-3 MIGRATED to testing (Debian testing watch)
[2025-04-27] Accepted libarchive 3.7.4-3 (source) into unstable (Peter Pentchev)
[2025-04-26] Accepted libarchive 3.7.4-2 (source) into unstable (Peter Pentchev)
[2024-11-11] Accepted libarchive 3.4.3-2+deb11u2 (source) into oldstable-security (Adrian Bunk)
[2024-11-11] Accepted libarchive 3.6.2-1+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-10] libarchive 3.7.4-1.1 MIGRATED to testing (Debian testing watch)
[2024-11-09] Accepted libarchive 3.6.2-1+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-11-03] Accepted libarchive 3.7.4-1.1 (source) into unstable (Salvatore Bonaccorso)

bugs [bug history graph]

all: 6
RC: 0
I&N: 4
M&W: 1
F&P: 1
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.8.9-1
3 bugs