Register | Log in

unarr

Choose email to subscribe with

general

source: unarr (main)
version: 1.0.1-1.1
maintainer: Alec Leamas (DMD)
arch: any
std-ver: 4.6.1
VCS: unknown

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.1-1
oldstable: 1.0.1-1.1

versioned links

1.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.1-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libunarr-dev
libunarr1

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-111273: unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the process.
CVE-2026-111274: unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.

Created: 2026-10-16 Last update: 2026-10-16 22:20

news

[2024-09-05] unarr REMOVED from testing (Debian testing watch)
[2024-09-04] Removed 1.0.1-1.1 from unstable (Debian FTP Masters)
[2022-12-07] unarr 1.0.1-1.1 MIGRATED to testing (Debian testing watch)
[2022-12-01] Accepted unarr 1.0.1-1.1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2018-10-15] unarr 1.0.1-1 MIGRATED to testing (Debian testing watch)
[2018-10-10] Accepted unarr 1.0.1-1 (source amd64) into unstable (Alec Leamas) (signed by: Sebastiaan Couwenberg)
[2018-10-01] unarr 0~20150801.d1be8c4-1 MIGRATED to testing (Debian testing watch)
[2018-09-25] Accepted unarr 0~20150801.d1be8c4-1 (source amd64) into unstable, unstable (Alec Leamas) (signed by: Sebastiaan Couwenberg)

bugs [bug history graph]

all: 0

links

homepage
buildd: logs, cross
popcon
browse source code
other distros
security tracker

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing