HomeFreeBSD

MFC r302075:

Description

MFC r302075:

Update libarchive to 3.2.1 (bugfix and security fix release)

List of vendor fixes:

  • fix exploitable heap overflow vulnerability in Rar decompression (vendor issue 719, CVE-2016-4302, TALOS-2016-0154)
  • fix exploitable stack based buffer overflow vulnebarility in mtree parse_device functionality (vendor PR 715, CVE-2016-4301, TALOS-2016-0153)
  • fix exploitable heap overflow vulnerability in 7-zip read_SubStreamsInfo (vendor issue 718, CVE-2016-4300, TALOS-2016-152)
  • fix integer overflow when computing location of volume descriptor (vendor issue 717)
  • fix buffer overflow when reading a crafred rar archive (vendor issue 521)
  • fix possible buffer overflow when reading ISO9660 archives on machines where sizeof(int) < sizeof(size_t) (vendor issue 711)
  • tar and cpio should fail if an input file named on the command line is missing (vendor issue 708)
  • fix incorrect writing of gnutar filenames that are exactly 512 bytes long (vendor issue 682)
  • allow tests to be run from paths that are equal or longer than 128 characters (vendor issue 657)
  • add memory allocation errors in archive_entry_xattr.c (vendor PR 603)
  • remove dead code in archive_entry_xattr_add_entry() (vendor PR 716)
  • fix broken decryption of ZIP files (vendor issue 553)
  • manpage style, typo and description fixes

Post-3.2.1 vendor fixes:

  • fix typo in cpio version reporting (Vendor PR 725, 726)
  • fix argument range of ctype functions in libarchive_fe/passphrase.c
  • fix ctype use and avoid empty loop bodies in WARC reader

Security: CVE-2016-4300, CVE-2016-4301, CVE-2016-4302

Details

Provenance
mmAuthored on
Parents
rS302294: MFV r302264:
Branches
Unknown
Tags
Unknown