diff --git a/SPECS/libarchive/CVE-2026-15028.patch b/SPECS/libarchive/CVE-2026-15028.patch new file mode 100644 index 00000000000..eae7d571501 --- /dev/null +++ b/SPECS/libarchive/CVE-2026-15028.patch @@ -0,0 +1,43 @@ +From d48daae2443fa9fed37291a2de7a20e88afcccdd Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libarchive/libarchive/pull/3252.patch +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index ecaf6c3..39759fc 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3244,13 +3244,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; +-- +2.45.4 + diff --git a/SPECS/libarchive/CVE-2026-16517.patch b/SPECS/libarchive/CVE-2026-16517.patch new file mode 100644 index 00000000000..37c059bba30 --- /dev/null +++ b/SPECS/libarchive/CVE-2026-16517.patch @@ -0,0 +1,58 @@ +From 061d3f3a9605471d3670765621c0772cbc037dde Mon Sep 17 00:00:00 2001 +From: datauwu <209150516+datauwu@users.noreply.github.com> +Date: Fri, 3 Jul 2026 17:36:50 +0800 +Subject: [PATCH] zip: avoid signed overflow in encrypted size checks + +Avoid adding the encryption overhead directly to entry sizes when deciding +whether Zip64 is needed or when updating the stored compressed size. + +For the Zip64 decision, compare against ZIP_4GB_MAX - additional_size. For +stored encrypted entries, use archive_ckd_add_i64() so the size update and +overflow check happen together. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libarchive/libarchive/commit/1c6e7b491f60fce335c20a9692f870d1f1ca39aa.patch +--- + libarchive/archive_write_set_format_zip.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/libarchive/archive_write_set_format_zip.c b/libarchive/archive_write_set_format_zip.c +index a9f2877..e267736 100644 +--- a/libarchive/archive_write_set_format_zip.c ++++ b/libarchive/archive_write_set_format_zip.c +@@ -53,6 +53,7 @@ + #include "archive_entry.h" + #include "archive_entry_locale.h" + #include "archive_hmac_private.h" ++#include "archive_integer.h" + #include "archive_private.h" + #include "archive_random_private.h" + #include "archive_write_private.h" +@@ -714,8 +715,13 @@ archive_write_zip_header(struct archive_write *a, struct archive_entry *entry) + default: + break; + } +- if (zip->entry_compression == COMPRESSION_STORE) +- zip->entry_compressed_size += additional_size; ++ if (zip->entry_compression == COMPRESSION_STORE && ++ archive_ckd_add_i64(&zip->entry_compressed_size, ++ zip->entry_compressed_size, additional_size)) { ++ archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, ++ "File size too large for encrypted ZIP entry"); ++ return (ARCHIVE_FAILED); ++ } + } + + /* +@@ -729,7 +735,7 @@ archive_write_zip_header(struct archive_write *a, struct archive_entry *entry) + * (compression might make file larger) + */ + if ((zip->flags & ZIP_FLAG_FORCE_ZIP64) +- || (zip->entry_uncompressed_size + additional_size > ZIP_4GB_MAX) ++ || (zip->entry_uncompressed_size > ZIP_4GB_MAX - additional_size) + || (zip->entry_uncompressed_size > ZIP_4GB_MAX_UNCOMPRESSED + && zip->entry_compression != COMPRESSION_STORE)) { + MIN_VERSION_NEEDED(45); +-- +2.45.4 + diff --git a/SPECS/libarchive/libarchive.spec b/SPECS/libarchive/libarchive.spec index b7f21510296..3615eaefa97 100644 --- a/SPECS/libarchive/libarchive.spec +++ b/SPECS/libarchive/libarchive.spec @@ -21,6 +21,8 @@ Patch9: CVE-2026-4424.patch Patch10: CVE-2026-4426.patch Patch11: CVE-2026-5121.patch Patch12: CVE-2026-14164.patch +Patch13: CVE-2026-15028.patch +Patch14: CVE-2026-16517.patch Provides: bsdtar = %{version}-%{release} BuildRequires: xz-libs @@ -78,8 +80,8 @@ make %{?_smp_mflags} check %{_libdir}/pkgconfig/*.pc %changelog -* Fri Jul 03 2026 Azure Linux Security Servicing Account - 3.7.7-7 -- Patch for CVE-2026-14164 +* Wed Jul 22 2026 Azure Linux Security Servicing Account - 3.7.7-7 +- Patch for CVE-2026-15028, CVE-2026-14164, CVE-2026-16517 * Fri Apr 17 2026 Azure Linux Security Servicing Account - 3.7.7-6 - Patch for CVE-2026-5121, CVE-2026-4426, CVE-2026-4424