From 40203fc9fd4894dadf0b4863ef5c8796b0101807 Mon Sep 17 00:00:00 2001 From: Jon Slobodzian Date: Sat, 1 Aug 2026 00:45:24 -0400 Subject: [PATCH] =?UTF-8?q?libarchive:=20rebuild=20#18280=20cherry-pick=20?= =?UTF-8?q?=E2=80=94=20add=20CVE-2026-15028=20&=20CVE-2026-16517?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The AI-generated cherry-pick left literal <<<<<<< HEAD conflict markers in libarchive.spec. Rebuild it as a hand-crafted mirror of fasttrack commit 83ed8439ec so 3.0-dev converges with fasttrack's canonical -7 state: add Patch13 (CVE-2026-15028) + Patch14 (CVE-2026-16517), consolidate the existing -7 changelog entry to list all three CVEs. Release stays 7 (no bump) since fasttrack itself is at -7. Note: fasttrack subsequently reverted CVE-2026-16517 (#18282) — that will be delivered by companion PR #18284, keeping 3.0-dev's history as a faithful mirror of fasttrack's two-step land-then-revert. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26b18818-c4ef-43b9-ad6c-26bbf7c5259e --- SPECS/libarchive/CVE-2026-15028.patch | 43 ++++++++++++++++++++ SPECS/libarchive/CVE-2026-16517.patch | 58 +++++++++++++++++++++++++++ SPECS/libarchive/libarchive.spec | 6 ++- 3 files changed, 105 insertions(+), 2 deletions(-) create mode 100644 SPECS/libarchive/CVE-2026-15028.patch create mode 100644 SPECS/libarchive/CVE-2026-16517.patch diff --git a/SPECS/libarchive/CVE-2026-15028.patch b/SPECS/libarchive/CVE-2026-15028.patch new file mode 100644 index 00000000000..eae7d571501 --- /dev/null +++ b/SPECS/libarchive/CVE-2026-15028.patch @@ -0,0 +1,43 @@ +From d48daae2443fa9fed37291a2de7a20e88afcccdd Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libarchive/libarchive/pull/3252.patch +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index ecaf6c3..39759fc 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3244,13 +3244,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; +-- +2.45.4 + diff --git a/SPECS/libarchive/CVE-2026-16517.patch b/SPECS/libarchive/CVE-2026-16517.patch new file mode 100644 index 00000000000..37c059bba30 --- /dev/null +++ b/SPECS/libarchive/CVE-2026-16517.patch @@ -0,0 +1,58 @@ +From 061d3f3a9605471d3670765621c0772cbc037dde Mon Sep 17 00:00:00 2001 +From: datauwu <209150516+datauwu@users.noreply.github.com> +Date: Fri, 3 Jul 2026 17:36:50 +0800 +Subject: [PATCH] zip: avoid signed overflow in encrypted size checks + +Avoid adding the encryption overhead directly to entry sizes when deciding +whether Zip64 is needed or when updating the stored compressed size. + +For the Zip64 decision, compare against ZIP_4GB_MAX - additional_size. For +stored encrypted entries, use archive_ckd_add_i64() so the size update and +overflow check happen together. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libarchive/libarchive/commit/1c6e7b491f60fce335c20a9692f870d1f1ca39aa.patch +--- + libarchive/archive_write_set_format_zip.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/libarchive/archive_write_set_format_zip.c b/libarchive/archive_write_set_format_zip.c +index a9f2877..e267736 100644 +--- a/libarchive/archive_write_set_format_zip.c ++++ b/libarchive/archive_write_set_format_zip.c +@@ -53,6 +53,7 @@ + #include "archive_entry.h" + #include "archive_entry_locale.h" + #include "archive_hmac_private.h" ++#include "archive_integer.h" + #include "archive_private.h" + #include "archive_random_private.h" + #include "archive_write_private.h" +@@ -714,8 +715,13 @@ archive_write_zip_header(struct archive_write *a, struct archive_entry *entry) + default: + break; + } +- if (zip->entry_compression == COMPRESSION_STORE) +- zip->entry_compressed_size += additional_size; ++ if (zip->entry_compression == COMPRESSION_STORE && ++ archive_ckd_add_i64(&zip->entry_compressed_size, ++ zip->entry_compressed_size, additional_size)) { ++ archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, ++ "File size too large for encrypted ZIP entry"); ++ return (ARCHIVE_FAILED); ++ } + } + + /* +@@ -729,7 +735,7 @@ archive_write_zip_header(struct archive_write *a, struct archive_entry *entry) + * (compression might make file larger) + */ + if ((zip->flags & ZIP_FLAG_FORCE_ZIP64) +- || (zip->entry_uncompressed_size + additional_size > ZIP_4GB_MAX) ++ || (zip->entry_uncompressed_size > ZIP_4GB_MAX - additional_size) + || (zip->entry_uncompressed_size > ZIP_4GB_MAX_UNCOMPRESSED + && zip->entry_compression != COMPRESSION_STORE)) { + MIN_VERSION_NEEDED(45); +-- +2.45.4 + diff --git a/SPECS/libarchive/libarchive.spec b/SPECS/libarchive/libarchive.spec index b7f21510296..3615eaefa97 100644 --- a/SPECS/libarchive/libarchive.spec +++ b/SPECS/libarchive/libarchive.spec @@ -21,6 +21,8 @@ Patch9: CVE-2026-4424.patch Patch10: CVE-2026-4426.patch Patch11: CVE-2026-5121.patch Patch12: CVE-2026-14164.patch +Patch13: CVE-2026-15028.patch +Patch14: CVE-2026-16517.patch Provides: bsdtar = %{version}-%{release} BuildRequires: xz-libs @@ -78,8 +80,8 @@ make %{?_smp_mflags} check %{_libdir}/pkgconfig/*.pc %changelog -* Fri Jul 03 2026 Azure Linux Security Servicing Account - 3.7.7-7 -- Patch for CVE-2026-14164 +* Wed Jul 22 2026 Azure Linux Security Servicing Account - 3.7.7-7 +- Patch for CVE-2026-15028, CVE-2026-14164, CVE-2026-16517 * Fri Apr 17 2026 Azure Linux Security Servicing Account - 3.7.7-6 - Patch for CVE-2026-5121, CVE-2026-4426, CVE-2026-4424