Accepted libarchive 3.3.3-4+deb10u2 (source) into oldstable
- To: debian-lts-changes@lists.debian.org, dispatch@tracker.debian.org
- Subject: Accepted libarchive 3.3.3-4+deb10u2 (source) into oldstable
- From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>
- Date: Tue, 22 Nov 2022 14:50:21 +0000
- Debian: DAK
- Debian-architecture: source
- Debian-archive-action: accept
- Debian-changes: libarchive_3.3.3-4+deb10u2_source.changes
- Debian-source: libarchive
- Debian-suite: oldstable
- Debian-version: 3.3.3-4+deb10u2
- Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.seger; h=Date:Message-Id: Content-Transfer-Encoding:Content-Type:Subject:MIME-Version:To:Reply-To:From: Cc:Content-ID:Content-Description:In-Reply-To:References; bh=p5Ck3RpR6BNZNo9Fcs8Y6e3bCpAHo2ptphjqc2EhJmg=; b=SeS5lxppQyPtOLxl3mgZFVlrUV TEGKz5t4Bj5krzlkMouv8TOfOMOi8U0TVr46khYtKW8ay7h/vc2ssc/f7gnIDMkOSc0K/NbYWv0mP Zf2bH3TcV+epRpupvvUNbDoAUyboAQ5B7gJj2Y4i8w4WRWBbTEMfgMjxKAQIKNMrndcE2pDAsF1VE yUIv7BZOmfxNVM2YnGGG9YQnorWYOgCaIbEt7M3KL1b0Wx5QbGGBO2l5umEyccCbW6cE6+GlAww7K K0nwgzJAZzOzmvslqpRhdVWaCufjaMdNpssimefqW+fJP40PfMafYebgMFV5mRamOno6S09Av/4od lpNVMPmg==;
- Mail-followup-to: debian-lts@lists.debian.org
- Message-id: <E1oxUbN-006zFx-96@seger.debian.org>
- Reply-to: debian-lts@lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 21 Nov 2022 16:48:59 +0100
Source: libarchive
Architecture: source
Version: 3.3.3-4+deb10u2
Distribution: buster-security
Urgency: high
Maintainer: Peter Pentchev <roam@debian.org>
Changed-By: Sylvain Beucler <beuc@debian.org>
Closes: 945287 1001986 1001990
Changes:
libarchive (3.3.3-4+deb10u2) buster-security; urgency=high
.
* Non-maintainer upload by the LTS Security Team.
* CVE-2019-19221: archive_wstring_append_from_mbs in archive_string.c
has an out-of-bounds read because of an incorrect mbrtowc or mbtowc
call. For example, bsdtar crashes via a crafted archive.
(Closes: #945287)
* CVE-2021-23177: an improper link resolution flaw while extracting an
archive can lead to changing the access control list (ACL) of the
target of the link. An attacker may provide a malicious archive to a
victim user, who would trigger this flaw when trying to extract the
archive. A local attacker may use this flaw to change the ACL of a
file on the system and gain more privileges. (Closes: #1001986)
* CVE-2021-31566: an improper link resolution flaw can occur while
extracting an archive leading to changing modes, times, access control
lists, and flags of a file outside of the archive. An attacker may
provide a malicious archive to a victim user, who would trigger this
flaw when trying to extract the archive. A local attacker may use this
flaw to gain more privileges in a system. (Closes: #1001990)
Checksums-Sha1:
9648bb8a593e3af4cfa43c55511cd86f9f9af47e 2389 libarchive_3.3.3-4+deb10u2.dsc
0678fc50d64a95e644b320e38c7446b738d369a3 24592 libarchive_3.3.3-4+deb10u2.debian.tar.xz
32eec367153439cbf0c6d6f23ffbfc438caec1a1 7410 libarchive_3.3.3-4+deb10u2_amd64.buildinfo
Checksums-Sha256:
06691583f7308cbee040af499751507d8c197d85e92bf20b268adb2ff12e7d30 2389 libarchive_3.3.3-4+deb10u2.dsc
895a83cc3c6de67969e1063ee3f51b3337a7dd128cedbb34e7132ea56c5431ae 24592 libarchive_3.3.3-4+deb10u2.debian.tar.xz
18d687a01a05509d1080d685bf8ed26bd39be390bc62cfa4c4cdf7e91bebbe29 7410 libarchive_3.3.3-4+deb10u2_amd64.buildinfo
Files:
078c92052835fc4c539b7702591545df 2389 libs optional libarchive_3.3.3-4+deb10u2.dsc
6673a3f079d96086145763e3a89d60bd 24592 libs optional libarchive_3.3.3-4+deb10u2.debian.tar.xz
b80655db8ba3e2b0a10c90f724d6485b 7410 libs optional libarchive_3.3.3-4+deb10u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmN83LoACgkQDTl9HeUl
XjCrBg/+OzBb+vNtW0lsM7up0PK52BSOG7k9/Vc3tVhYU4jTsOFR/7T5AfNDrj1O
6ZROlqSAkhUHAEmaeDgmytCCjfHYB+AE2cSySX/0NelDiiEJTPW3RHgd9LbW1Ntu
mwq6lMxqLxAogGN38+dhY5qUSnF01k5ldFZzwIScakZNtWQ8YgZiCO8rcjrN7DeL
AWek0w3RJ4uXthX5pJIifZg9vsDJs4slj8/jerFhHcovENbCb4pp0bSx7E+80LC+
eh8hZVkWQjBIIwBDqZwXbNr3gM6oMJoMUqOLfrZP21OxKv9ZqO8Q7vXttrl5Vt6x
ueYV0TnrFM2wt5XX5+bsawz0as86Zm5AsLn+jmBqChtm+y0hekYU7NhYERElzjGd
VDZgbFf/RSUWFA8/xwJKnyyYiuGdl44uBUTRGzdBheH8iJsxKHPUqTsWErsatVc3
pKEGaQ4P3TSYXyczo+7S9Aw0PpFcgabaIYJFA423fo9bpGdsiskV/8dttolBeJBW
lytV8UdyIoBcFIby8lTC/Vpi5HaSI7w46UiGK3P/SoaEo0BCXy+enJynT6hHmQIn
sWU8DFrO/0Oy443KmhKHHnk4JfacoUo+xrV9mvRSZysjtkMGoM0w+awXPfe021Jt
u8atNuaJkM5iBFiKo6xAX7PxJJn/DhSoHFEvt4cH1LSJfGSd8zk=
=eVHX
-----END PGP SIGNATURE-----