Back to libarchive PTS page

Accepted libarchive 3.3.3-4+deb10u2 (source) into oldstable



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 21 Nov 2022 16:48:59 +0100
Source: libarchive
Architecture: source
Version: 3.3.3-4+deb10u2
Distribution: buster-security
Urgency: high
Maintainer: Peter Pentchev <roam@debian.org>
Changed-By: Sylvain Beucler <beuc@debian.org>
Closes: 945287 1001986 1001990
Changes:
 libarchive (3.3.3-4+deb10u2) buster-security; urgency=high
 .
   * Non-maintainer upload by the LTS Security Team.
   * CVE-2019-19221: archive_wstring_append_from_mbs in archive_string.c
     has an out-of-bounds read because of an incorrect mbrtowc or mbtowc
     call. For example, bsdtar crashes via a crafted archive.
     (Closes: #945287)
   * CVE-2021-23177: an improper link resolution flaw while extracting an
     archive can lead to changing the access control list (ACL) of the
     target of the link. An attacker may provide a malicious archive to a
     victim user, who would trigger this flaw when trying to extract the
     archive. A local attacker may use this flaw to change the ACL of a
     file on the system and gain more privileges. (Closes: #1001986)
   * CVE-2021-31566: an improper link resolution flaw can occur while
     extracting an archive leading to changing modes, times, access control
     lists, and flags of a file outside of the archive. An attacker may
     provide a malicious archive to a victim user, who would trigger this
     flaw when trying to extract the archive. A local attacker may use this
     flaw to gain more privileges in a system. (Closes: #1001990)
Checksums-Sha1:
 9648bb8a593e3af4cfa43c55511cd86f9f9af47e 2389 libarchive_3.3.3-4+deb10u2.dsc
 0678fc50d64a95e644b320e38c7446b738d369a3 24592 libarchive_3.3.3-4+deb10u2.debian.tar.xz
 32eec367153439cbf0c6d6f23ffbfc438caec1a1 7410 libarchive_3.3.3-4+deb10u2_amd64.buildinfo
Checksums-Sha256:
 06691583f7308cbee040af499751507d8c197d85e92bf20b268adb2ff12e7d30 2389 libarchive_3.3.3-4+deb10u2.dsc
 895a83cc3c6de67969e1063ee3f51b3337a7dd128cedbb34e7132ea56c5431ae 24592 libarchive_3.3.3-4+deb10u2.debian.tar.xz
 18d687a01a05509d1080d685bf8ed26bd39be390bc62cfa4c4cdf7e91bebbe29 7410 libarchive_3.3.3-4+deb10u2_amd64.buildinfo
Files:
 078c92052835fc4c539b7702591545df 2389 libs optional libarchive_3.3.3-4+deb10u2.dsc
 6673a3f079d96086145763e3a89d60bd 24592 libs optional libarchive_3.3.3-4+deb10u2.debian.tar.xz
 b80655db8ba3e2b0a10c90f724d6485b 7410 libs optional libarchive_3.3.3-4+deb10u2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmN83LoACgkQDTl9HeUl
XjCrBg/+OzBb+vNtW0lsM7up0PK52BSOG7k9/Vc3tVhYU4jTsOFR/7T5AfNDrj1O
6ZROlqSAkhUHAEmaeDgmytCCjfHYB+AE2cSySX/0NelDiiEJTPW3RHgd9LbW1Ntu
mwq6lMxqLxAogGN38+dhY5qUSnF01k5ldFZzwIScakZNtWQ8YgZiCO8rcjrN7DeL
AWek0w3RJ4uXthX5pJIifZg9vsDJs4slj8/jerFhHcovENbCb4pp0bSx7E+80LC+
eh8hZVkWQjBIIwBDqZwXbNr3gM6oMJoMUqOLfrZP21OxKv9ZqO8Q7vXttrl5Vt6x
ueYV0TnrFM2wt5XX5+bsawz0as86Zm5AsLn+jmBqChtm+y0hekYU7NhYERElzjGd
VDZgbFf/RSUWFA8/xwJKnyyYiuGdl44uBUTRGzdBheH8iJsxKHPUqTsWErsatVc3
pKEGaQ4P3TSYXyczo+7S9Aw0PpFcgabaIYJFA423fo9bpGdsiskV/8dttolBeJBW
lytV8UdyIoBcFIby8lTC/Vpi5HaSI7w46UiGK3P/SoaEo0BCXy+enJynT6hHmQIn
sWU8DFrO/0Oy443KmhKHHnk4JfacoUo+xrV9mvRSZysjtkMGoM0w+awXPfe021Jt
u8atNuaJkM5iBFiKo6xAX7PxJJn/DhSoHFEvt4cH1LSJfGSd8zk=
=eVHX
-----END PGP SIGNATURE-----