rpms/libarchive
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix for CVE-2026-14164

Browse Source 
Resolves: RHEL-190435
This commit is contained in:
Pavol Sloboda 2026-06-30 15:58:15 +02:00
parent d44820e0f5
commit 178c5dc75f
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libarchive-3.5.3-Fix-CVE-2026-14164.patch Normal file
View File

@ -0,0 +1,22 @@
# Patch sources from libarchive upstream
# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
diff -Naur libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c
--- libarchive-3.5.3/libarchive/archive_read_support_format_rar5.c 2022-02-08 09:44:39.000000000 +0100
+++ libarchive-3.5.3_patched/libarchive/archive_read_support_format_rar5.c 2026-06-30 15:28:28.055651344 +0200
@@ -2340,12 +2340,12 @@
free(rar->cstate.window_buf);
free(rar->cstate.filtered_buf);
+ rar->cstate.window_buf = NULL;
+ rar->cstate.filtered_buf = NULL;
+
if(rar->cstate.window_size > 0) {
rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
- } else {
- rar->cstate.window_buf = NULL;
- rar->cstate.filtered_buf = NULL;
}
rar->cstate.write_ptr = 0;

7
libarchive.spec
View File

@ -2,7 +2,7 @@
Name: libarchive
Version: 3.5.3
Release: 9%{?dist}
Release: 10%{?dist}
Summary: A library for handling streaming archive formats
License: BSD
@ -27,6 +27,8 @@ Patch7: %{name}-3.5.3-Fix-CVE-2026-4111.patch
Patch8: %{name}-3.5.3-Fix-CVE-2026-4424.patch
# Source: https://github.com/libarchive/libarchive/pull/2934/changes/889a228b71f2b1fab8dc5610f6c43ac0e9b92160
Patch9: %{name}-3.5.3-Fix-CVE-2026-5121.patch
# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
Patch10: %{name}-3.5.3-Fix-CVE-2026-14164.patch
BuildRequires: automake
@ -234,6 +236,9 @@ run_testsuite
%changelog
* Tue Jun 30 2026 Pavol Sloboda <psloboda@redhat.com> - 3.5.3-10
- Resolves: CVE-2026-14164
* Thu Apr 09 2026 Pavol Sloboda <psloboda@redhat.com> - 3.5.3-9
- Resolves: CVE-2026-4424
- Resolves: CVE-2026-5121