diff mbox series

libarchive: upgrade 3.8.6 -> 3.8.7

Message ID 20260415173712.1451880-1-peter.marko@siemens.com
State New
Headers show
Series libarchive: upgrade 3.8.6 -> 3.8.7 | expand

Commit Message

Peter Marko April 15, 2026, 5:37 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Solves CVE-2026-5121 (points to [2] per [3]).
Since it's Redhat version-less CVE, add explicit CVE_STATUS.

Release information [1]:

Libarchive 3.8.6 is a security and bugfix release.

Notable fixes:

* CAB: fix NULL pointer dereference during skip (#2900)
* CAB: Fix Heap OOB Write in CAB LZX decoder (#2919)
* cpio: various fixes and improvements (#2899, #2908, #2910, #2939)
* contrib/untar: fix out-of-bounds read (#2903)
* iso9660: fix undefined behavior (#2897)
* iso9660: fix posibble heap buffer overflow on 32-bit systems (#2934)
* libarchive: fix handling of option failures (#2871)
* libarchive: do not continue with truncated numbers (#2911)
* libarchive: lzop and grzip filter support (#2947)
* RAR: fix LZSS window size mismatch after PPMd block (#2898)

[1] https://github.com/libarchive/libarchive/releases/tag/v3.8.7
[2] https://github.com/libarchive/libarchive/pull/2934
[3] https://security-tracker.debian.org/tracker/CVE-2026-5121

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../libarchive/{libarchive_3.8.6.bb => libarchive_3.8.7.bb}   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 rename meta/recipes-extended/libarchive/{libarchive_3.8.6.bb => libarchive_3.8.7.bb} (95%)
diff mbox series

Patch

diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.6.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
similarity index 95%
rename from meta/recipes-extended/libarchive/libarchive_3.8.6.bb
rename to meta/recipes-extended/libarchive/libarchive_3.8.7.bb
index d579cdb65a..a65afb7b22 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.8.6.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
@@ -34,7 +34,7 @@  SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \
           "
 UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
 
-SRC_URI[sha256sum] = "213269b05aac957c98f6e944774bb438d0bd168a2ec60b9e4f8d92035925821c"
+SRC_URI[sha256sum] = "4b787cca6697a95c7725e45293c973c208cbdc71ae2279f30ef09f52472b9166"
 
 inherit autotools update-alternatives pkgconfig ptest
 
@@ -88,3 +88,5 @@  do_install_ptest() {
 }
 
 RDEPENDS:${PN}-ptest += "bsdtar bsdcpio"
+
+CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7"