Summary
[3.5.3-9]
- Resolves: CVE-2026-4424
- Resolves: CVE-2026-5121
[3.5.3-8]
- Release bump
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bsdtar | 0:3.5.3-9.el9_7 |
| Oracle Linux · 9 | libarchive | 0:3.5.3-9.el9_7 |
| Oracle Linux · 9 | libarchive-devel | 0:3.5.3-9.el9_7 |
Vulnerabilities 2
-
High 7.5
Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this …
-
High 7.5
Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing
A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overfl…