Skip to content

[AUTO-CHERRYPICK] [AutoPR- Security] Patch libarchive for CVE-2026-15028, CVE-2026-14164, CVE-2026-16517 [HIGH] - branch 3.0-dev #18280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
azurelinux-ci-jwt-app wants to merge 1 commit into from
Closed

[AUTO-CHERRYPICK] [AutoPR- Security] Patch libarchive for CVE-2026-15028, CVE-2026-14164, CVE-2026-16517 [HIGH] - branch 3.0-dev #18280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions SPECS/libarchive/CVE-2026-15028.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
From d48daae2443fa9fed37291a2de7a20e88afcccdd Mon Sep 17 00:00:00 2001
From: datauwu <datauwu@users.noreply.github.com>
Date: Mon, 6 Jul 2026 21:51:15 +0800
Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing

header_pax_extension() passes PAX attribute values without the trailing
newline to pax_attribute(). The SUN.holesdata parser read one byte past
the supplied value when the last numeric field ended at the value
boundary.

Handle length == 0 before checking *e.

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: https://github.com/libarchive/libarchive/pull/3252.patch
---
libarchive/archive_read_support_format_tar.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c
index ecaf6c3..39759fc 100644
--- a/libarchive/archive_read_support_format_tar.c
+++ b/libarchive/archive_read_support_format_tar.c
@@ -3244,13 +3244,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar,
return (ARCHIVE_FATAL);
tar->sparse_last->hole = hole;
}
- if (length == 0 || *e == '\n') {
- if (length == 0 && *e == '\n') {
- return (ARCHIVE_OK);
- } else {
- return (ARCHIVE_WARN);
- }
- }
+ if (length == 0)
+ return (ARCHIVE_OK);
+ if (*e == '\n')
+ return (ARCHIVE_WARN);
p = e + 1;
length--;
hole = hole == 0;
--
2.45.4

58 changes: 58 additions & 0 deletions SPECS/libarchive/CVE-2026-16517.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
From 061d3f3a9605471d3670765621c0772cbc037dde Mon Sep 17 00:00:00 2001
From: datauwu <209150516+datauwu@users.noreply.github.com>
Date: Fri, 3 Jul 2026 17:36:50 +0800
Subject: [PATCH] zip: avoid signed overflow in encrypted size checks

Avoid adding the encryption overhead directly to entry sizes when deciding
whether Zip64 is needed or when updating the stored compressed size.

For the Zip64 decision, compare against ZIP_4GB_MAX - additional_size. For
stored encrypted entries, use archive_ckd_add_i64() so the size update and
overflow check happen together.

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: https://github.com/libarchive/libarchive/commit/1c6e7b491f60fce335c20a9692f870d1f1ca39aa.patch
---
libarchive/archive_write_set_format_zip.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/libarchive/archive_write_set_format_zip.c b/libarchive/archive_write_set_format_zip.c
index a9f2877..e267736 100644
--- a/libarchive/archive_write_set_format_zip.c
+++ b/libarchive/archive_write_set_format_zip.c
@@ -53,6 +53,7 @@
#include "archive_entry.h"
#include "archive_entry_locale.h"
#include "archive_hmac_private.h"
+#include "archive_integer.h"
#include "archive_private.h"
#include "archive_random_private.h"
#include "archive_write_private.h"
@@ -714,8 +715,13 @@ archive_write_zip_header(struct archive_write *a, struct archive_entry *entry)
default:
break;
}
- if (zip->entry_compression == COMPRESSION_STORE)
- zip->entry_compressed_size += additional_size;
+ if (zip->entry_compression == COMPRESSION_STORE &&
+ archive_ckd_add_i64(&zip->entry_compressed_size,
+ zip->entry_compressed_size, additional_size)) {
+ archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+ "File size too large for encrypted ZIP entry");
+ return (ARCHIVE_FAILED);
+ }
}

/*
@@ -729,7 +735,7 @@ archive_write_zip_header(struct archive_write *a, struct archive_entry *entry)
* (compression might make file larger)
*/
if ((zip->flags & ZIP_FLAG_FORCE_ZIP64)
- || (zip->entry_uncompressed_size + additional_size > ZIP_4GB_MAX)
+ || (zip->entry_uncompressed_size > ZIP_4GB_MAX - additional_size)
|| (zip->entry_uncompressed_size > ZIP_4GB_MAX_UNCOMPRESSED
&& zip->entry_compression != COMPRESSION_STORE)) {
MIN_VERSION_NEEDED(45);
--
2.45.4

6 changes: 4 additions & 2 deletions SPECS/libarchive/libarchive.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,8 @@ Patch9: CVE-2026-4424.patch
Patch10: CVE-2026-4426.patch
Patch11: CVE-2026-5121.patch
Patch12: CVE-2026-14164.patch
Patch13: CVE-2026-15028.patch
Patch14: CVE-2026-16517.patch
Provides: bsdtar = %{version}-%{release}

BuildRequires: xz-libs
Expand Down Expand Up @@ -78,8 +80,8 @@ make %{?_smp_mflags} check
%{_libdir}/pkgconfig/*.pc

%changelog
* Fri Jul 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.7.7-7
- Patch for CVE-2026-14164
* Wed Jul 22 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.7.7-7
- Patch for CVE-2026-15028, CVE-2026-14164, CVE-2026-16517

* Fri Apr 17 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.7.7-6
- Patch for CVE-2026-5121, CVE-2026-4426, CVE-2026-4424
Expand Down
Loading