rpms/libarchive
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix for CVE-2026-14164

Browse Source 
Resolves: RHEL-190437
This commit is contained in:
Pavol Sloboda 2026-06-30 16:20:34 +02:00
parent e257340a1e
commit 9e687095ab
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
0007-Fix-CVE-2026-14164.patch Normal file
View File

@ -0,0 +1,22 @@
# Patch sources from libarchive upstream
# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
diff -Naur libarchive-3.7.7/libarchive/archive_read_support_format_rar5.c libarchive-3.7.7_patched/libarchive/archive_read_support_format_rar5.c
--- libarchive-3.7.7/libarchive/archive_read_support_format_rar5.c 2024-10-13 10:11:23.000000000 +0200
+++ libarchive-3.7.7_patched/libarchive/archive_read_support_format_rar5.c 2026-06-30 16:12:48.145167461 +0200
@@ -2487,12 +2487,12 @@
free(rar->cstate.window_buf);
free(rar->cstate.filtered_buf);
+ rar->cstate.window_buf = NULL;
+ rar->cstate.filtered_buf = NULL;
+
if(rar->cstate.window_size > 0) {
rar->cstate.window_buf = calloc(1, rar->cstate.window_size);
rar->cstate.filtered_buf = calloc(1, rar->cstate.window_size);
- } else {
- rar->cstate.window_buf = NULL;
- rar->cstate.filtered_buf = NULL;
}
clear_data_ready_stack(rar);

7
libarchive.spec
View File

@ -2,7 +2,7 @@
Name: libarchive
Version: 3.7.7
Release: 8%{?dist}
Release: 9%{?dist}
Summary: A library for handling streaming archive formats
# Licenses:
@ -55,6 +55,8 @@ Patch0005: 0005-Infinite-loop-in-Rar5-decompression.patch
# Source: https://github.com/libarchive/libarchive/pull/2898/changes/d379dc0b2976b7207d1ad78f5ed3eb99a5b6d375
# and: https://github.com/libarchive/libarchive/pull/2898/changes/e1907c5832b6489c7b4198b0825f857c93a03c10
Patch0006: 0006-Fix-CVE-2026-4424.patch
# Source: https://github.com/libarchive/libarchive/pull/3071/changes/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61
Patch0007: 0007-Fix-CVE-2026-14164.patch
%description
Libarchive is a programming library that can create and read several different
@ -264,6 +266,9 @@ run_testsuite
%changelog
* Tue Jun 30 2026 Pavol Sloboda <psloboda@redhat.com> - 3.7.7-9
- Resolves: CVE-2026-14164
* Wed Apr 08 2026 Pavol Sloboda <psloboda@redhat.com> - 3.7.7-8
- Resolves: CVE-2026-4424