Arnaud Rebillout pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2175f691 by Arnaud Rebillout at 2026-05-05T11:01:03+07:00
Reserve DLA-4563-1 for libarchive
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -27373,7 +27373,6 @@ CVE-2026-4111 (A flaw was identified in the RAR5
archive decompression logic of
- libarchive 3.8.6-1 (bug #1130753)
[trixie] - libarchive <no-dsa> (Minor issue)
[bookworm] - libarchive <no-dsa> (Minor issue)
- [bullseye] - libarchive <postponed> (Minor issue, DoS)
NOTE: https://github.com/libarchive/libarchive/pull/2877
NOTE: Testcase:
https://github.com/libarchive/libarchive/commit/ef53e2023d75a205cf7cbddb5d01c4cc592e9ce4
NOTE: Fixed by:
https://github.com/libarchive/libarchive/commit/7273d04803a1e5a482f26d8d0fbaf2b204a72168
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[05 May 2026] DLA-4563-1 libarchive - security update
+ {CVE-2026-4111 CVE-2026-4424 CVE-2026-4426 CVE-2026-5121}
+ [bullseye] - libarchive 3.4.3-2+deb11u4
[04 May 2026] DLA-4562-1 thunderbird - security update
{CVE-2026-7320 CVE-2026-7321 CVE-2026-7322 CVE-2026-7323}
[bullseye] - thunderbird 1:140.10.1esr-1~deb11u1
=====================================
data/dla-needed.txt
=====================================
@@ -246,10 +246,6 @@ lemonldap-ng
NOTE: 20251229: Asked yadd (maintainer of package) for help (abhijith)
NOTE: 20260504: Maintainer prepared fix for CVE-2025-59518 (abhijith)
--
-libarchive (arnaudr)
- NOTE: 20260405: Added by Front-Desk (ta)
- NOTE: 20260405: no upstream fix yet
---
libpng1.6 (tobi)
NOTE: 20260419: Added by Front-Desk (rouca)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2175f691cea8340409b67925a0eac785eef4909e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2175f691cea8340409b67925a0eac785eef4909e
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
