Summary
This update for libarchive fixes the following issues:
libarchive was updated to version 3.3.3
* Avoid super-linear slowdown on malformed mtree files
* Many fixes for building with Visual Studio
* NO_OVERWRITE doesn't change existing directory attributes
* New support for Zstandard read and write filters
* Fixes CVE-2017-14501, CVE-2017-14502, CVE-2017-14503
- Needed by of Firefox91 (bsc#1188891)
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| SUSE · Enterprise Storage 6 | libarchive | 3.3.3-3.14.1 |
| SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-ESPOS | libarchive | 3.3.3-3.14.1 |
| SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-LTSS | libarchive | 3.3.3-3.14.1 |
| SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-ESPOS | libarchive | 3.3.3-3.14.1 |
| SUSE · SLE HPC 15 Linux Enterprise High Performance Computing 15-LTSS | libarchive | 3.3.3-3.14.1 |
| SUSE · SLES 15 SP1 Linux Enterprise Server 15 SP1-BCL | libarchive | 3.3.3-3.14.1 |
| SUSE · SLES 15 SP1 Linux Enterprise Server 15 SP1-LTSS | libarchive | 3.3.3-3.14.1 |
| SUSE · SLES 15 Linux Enterprise Server 15-LTSS | libarchive | 3.3.3-3.14.1 |
| SUSE · SLES for SAP 15 Linux Enterprise Server for SAP Applications 15 | libarchive | 3.3.3-3.14.1 |
| SUSE · SLES for SAP 15 SP1 Linux Enterprise Server for SAP Applications 15 SP1 | libarchive | 3.3.3-3.14.1 |
| SUSE · Manager Proxy 4.0 | libarchive | 3.3.3-3.14.1 |
| SUSE · Manager Retail Branch Server 4.0 | libarchive | 3.3.3-3.14.1 |
| SUSE · Manager Server 4.0 | libarchive | 3.3.3-3.14.1 |
Vulnerabilities 5
-
Unscored —
libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and applica…
-
Unscored —
An out-of-bounds read flaw exists in parse_file_info in archive_read_support_format_iso9660.c in libarchive 3.3.2 when …
-
Unscored —
read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names …
-
Unscored —
libarchive 3.3.2 suffers from an out-of-bounds read within lha_read_data_none() in archive_read_support_format_lha.c wh…
-
Unscored —
archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free …
References
-
report
https://bugzilla.suse.com/1188891
-
web
https://www.suse.com/security/cve/CVE-2017-14166
-
web
https://www.suse.com/security/cve/CVE-2017-14501
-
web
https://www.suse.com/security/cve/CVE-2017-14502
-
web
https://www.suse.com/security/cve/CVE-2017-14503
-
web
https://www.suse.com/security/cve/CVE-2019-18408