import UBI libarchive-3.7.7-3.el10_0

0003-Fix-CVE-2025-25724.patch

@@ -0,0 +1,37 @@
+From c9bc934e7e91d302e0feca6e713ccc38d6d01532 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Peter=20K=C3=A4stle?= <peter@piie.net>
+Date: Mon, 10 Mar 2025 16:43:04 +0100
+Subject: [PATCH] fix CVE-2025-1632 and CVE-2025-25724 (#2532)
+
+Hi,
+
+please find my approach to fix the CVE-2025-25724
+vulnerabilities in this pr.
+As both error cases did trigger a NULL pointer deref (and triggered
+hopefully everywhere a coredump), we can safely replace the actual
+information by a predefined invalid string without breaking any
+functionality.
+
+---------
+
+Signed-off-by: Peter Kaestle <peter@piie.net>
+---
+ tar/util.c       |  5 ++++-
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/tar/util.c b/tar/util.c
+index 3b099cb5..f3cbdf0b 100644
+--- a/tar/util.c
++++ b/tar/util.c
+@@ -749,7 +749,10 @@ list_item_verbose(struct bsdtar *bsdtar, FILE *out, struct archive_entry *entry)
+ #else
+ 	ltime = localtime(&tim);
+ #endif
+-	strftime(tmp, sizeof(tmp), fmt, ltime);
++	if (ltime)
++		strftime(tmp, sizeof(tmp), fmt, ltime);
++	else
++		sprintf(tmp, "-- -- ----");
+ 	fprintf(out, " %s ", tmp);
+ 	safe_fprintf(out, "%s", archive_entry_pathname(entry));
+ 

libarchive.spec

@@ -2,7 +2,7 @@
 
 Name:           libarchive
 Version:        3.7.7
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A library for handling streaming archive formats
 
 # Licenses:
@@ -46,6 +46,8 @@ Patch0001: 0001-Drop-rmd160-from-OpenSSL.patch
 # Upstream commit: https://github.com/libarchive/libarchive/commit/82912103214506316bd9990d73f33d743d55f570
 # Fixes the CVE-2024-57970
 Patch0002: 0002-Handle-truncation-in-the-middle-of-a-GNU-long-linkna.patch
+# Source: https://github.com/libarchive/libarchive/commit/c9bc934e7e91d302e0feca6e713ccc38d6d01532
+Patch0003: 0003-Fix-CVE-2025-25724.patch
 
 %description
 Libarchive is a programming library that can create and read several different
@@ -244,6 +246,9 @@ run_testsuite
 
 
 %changelog
+* Fri Jun 06 2025 Lukas Javorsky <ljavorsk@redhat.com> - 3.7.7-3
+- Resolves: CVE-2025-25724
+
 * Tue Mar 04 2025 Nikola Davidova <ndavidov@redhat.com> - 3.7.7-2
 - Fix for CVE-2024-57970
 - Resolves: RHEL-79877