Ubuntu alert USN-7601-1 (libarchive)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7601-1] libarchive vulnerabilities
Date:
             
 
Thu, 26 Jun 2025 13:19:26 +0000
Message-ID:
             
 
<E1uUmVi-0002lQ-HR@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7601-1
June 26, 2025

libarchive vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.04
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in libarchive.

Software Description:
- libarchive: Library to read/write archive files

Details:

It was discovered that libarchive incorrectly handled certain RAR archive
files. An attacker could possibly use this issue to execute arbitrary
code or cause a denial of service. (CVE-2025-5914)

It was discovered that libarchive incorrectly handled certain RAR archive
files. An attacker could possibly use this issue to read sensitive data
or cause a denial of service. (CVE-2025-5915)

It was discovered that libarchive incorrectly handled certain WARC
archive files. If a user or automated system were tricked into processing
a specially crafted WARC archive, an attacker could use this issue to
cause libarchive to crash, resulting in a denial of service.
(CVE-2025-5916)

It was discovered that libarchive incorrectly handled certain file names
when handling prefixes and suffixes. An attacker could possibly use this
issue to cause libarchive to crash, resulting in a denial of service.
(CVE-2025-5917)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  libarchive13t64                 3.7.7-0ubuntu2.3

Ubuntu 24.10
  libarchive13t64                 3.7.4-1ubuntu0.3

Ubuntu 24.04 LTS
  libarchive13t64                 3.7.2-2ubuntu0.5

Ubuntu 22.04 LTS
  libarchive13                    3.6.0-1ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7601-1
  CVE-2025-5914, CVE-2025-5915, CVE-2025-5916, CVE-2025-5917

Package Information:
  https://launchpad.net/ubuntu/+source/libarchive/3.7.7-0ub...
  https://launchpad.net/ubuntu/+source/libarchive/3.7.4-1ub...
  https://launchpad.net/ubuntu/+source/libarchive/3.7.2-2ub...
  https://launchpad.net/ubuntu/+source/libarchive/3.6.0-1ub...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmhdSK8ACgkQcpJm3tlz
hgH4MRAAp0/hUnfEWkdLqWvmMN6oQtgNDlae5muG9d8LssVOMiF8pO5AlhW8ayPF
gYvCZ5GkfFw4Nmj5fmlFPziJPnI9jbvXelF6YEZrlr3MvaDhZUyJQLswpSzuwsZX
CyyJovd9ZWW67cvtuQ5nM2LoSdiUOWnj0aB66xMWjoGnn/odxb0VEYcdKtEbMVvK
eFo359CYOzc7tbJjKD/1fPiMV6kss46lqzmA4j2nHwQtu1x4ZEDww9pJb8DjhgXP
EYET+z8WGcgRS7Px18W9YOAbgT2tUdSAagzy1FQLITG+sY8SlSvMlZuoi4WZvX+b
sC3ixKuwogTqp1U1f6StlJJB3iQYZPydIAnhUDoDLYUxIG+F25jXi+IhFL4INVty
/y35anuJmJaEUjRPP+B1qT9EpDgdYfC7K5j+Ms4HX2ogreB+yFS9yMDGnySfQu2F
QQVzoT6WpVXWOQFDWZYPQ744p8kANuV+nLPsy4OrVDIM88gY6dj/QpcTjWha2255
ptV4lmSDlpRNbBdjmiG1JbCCGwtsxN7x0+xG1uy67erTbEuMA0iP9c/rB1wtxSgH
L8ySIliyHQGHmpYRSheMpaXI/bJ8L6e/V3ag5gCk69lWQBQlOwPvfdxU7fkUEATP
MuYA5EFHbZjCFx076GRXE4g3+qjYUa/p0NwHqmo3XLRM5C3gths=
=1cpM
-----END PGP SIGNATURE-----