[ubuntu/resolute-security] libarchive 3.8.5-1ubuntu2.2 (Accepted)

[Kyle Kernick]

libarchive (3.8.5-1ubuntu2.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Double free in init_unpack.
    - debian/patches/CVE-2026-14164.patch: Avoid dangling pointers in
      libarchive/archive_read_support_format_rar5.c
    - CVE-2026-14164
  * SECURITY UPDATE: Heap overflow in SUN.holesdata parsing
    - debian/patches/CVE-2026-15028-1.patch: Fix 1-byte OOB read in
      libarchive/archive_read_support_format_tar.c
    - debian/patches/CVE-2026-15028-2.patch: Add test case in
      libarchive/test/test_read_format_tar_pax_sun_holesdata.c and
      ../test_read_format_tar_pax_sun_holesdata.tar.uu
    - CVE-2026-15028
  * SECURITY UPDATE: NULL pointer dereference in archive_acl_from_text_nl.
    - debian/patches/CVE-2026-5745.patch: Fix NULL pointer dereference in
      libarchive/archive_acl.c
    - CVE-2026-5745

Date: 2026-07-20 20:37:18.700404+00:00
Changed-By: Kyle Kernick <kyle.kernick at canonical.com>
https://launchpad.net/ubuntu/+source/libarchive/3.8.5-1ubuntu2.2
-------------- next part --------------
Sorry, changesfile not available.