Ubuntu alert USN-8581-1 (libarchive)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8581-1] libarchive vulnerabilities
Date:
             
 
Wed, 22 Jul 2026 20:32:31 +0000
Message-ID:
             
 
<E1wmdcF-0003du-Vc@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8581-1
July 21, 2026

libarchive vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in libarchive.

Software Description:
- libarchive: Library to read/write archive files

Details:

It was discovered that libarchive did not properly manage memory when
unpacking certain RAR5 archives, leading to a double free. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2026-14164)

It was discovered that libarchive did not properly validate certain tar
archives, leading to a buffer overflow. A remote attacker could possibly
use this issue to cause a denial of service or execute arbitrary code.
This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15028)

It was discovered that libarchive did not properly validate certain
malformed ACL entries. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-5745)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libarchive-dev                  3.8.5-1ubuntu2.2
  libarchive-tools                3.8.5-1ubuntu2.2
  libarchive13t64                 3.8.5-1ubuntu2.2

Ubuntu 24.04 LTS
  libarchive-dev                  3.7.2-2ubuntu0.8
  libarchive-tools                3.7.2-2ubuntu0.8
  libarchive13t64                 3.7.2-2ubuntu0.8

Ubuntu 22.04 LTS
  libarchive-dev                  3.6.0-1ubuntu1.8
  libarchive-tools                3.6.0-1ubuntu1.8
  libarchive13                    3.6.0-1ubuntu1.8

Ubuntu 20.04 LTS
  libarchive-dev                  3.4.0-2ubuntu1.5+esm3
                                  Available with Ubuntu Pro
  libarchive-tools                3.4.0-2ubuntu1.5+esm3
                                  Available with Ubuntu Pro
  libarchive13                    3.4.0-2ubuntu1.5+esm3
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8581-1
  CVE-2026-14164, CVE-2026-15028, CVE-2026-5745

Package Information:
  https://launchpad.net/ubuntu/+source/libarchive/3.8.5-1ub...
  https://launchpad.net/ubuntu/+source/libarchive/3.7.2-2ub...
  https://launchpad.net/ubuntu/+source/libarchive/3.6.0-1ub...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpfxjIACgkQcpJm3tlz
hgEeVA/+JvZLNaBNhqUN4ZS5qH/y3saoX6o6CSrK7l7DEpMuYueNh7kXnVEq6jqA
jxV3uLWhDdyvb9mU1+FKB9rWdKG9VbLhwOHz5qTMIktn8Kt8xlTCqBMlbhQ8J4sp
+woT9hpytOAyjUyAomaMlfWmSGR5kZQNmckRCAS72dPw09CeP71fijeXO+aMJyek
uaK6klCP9Q1m3qv/XYCbR3IsvJqPewwl8JriJTUIhpUf+3pXkhoyIb716D63GHVv
9AM0xAzBsafEMR9LZ3sf7Qiak+gBsSoVikAjyHdz/z4iIy0rcLgRM6j4WnUUMYH8
/zOx+uaTfHobTAhJJWvbWQNDHVNM2ROUO1kOqNRdVWsub9NcUNS/jflCElj5OSWB
CAvCwBCGH8PQRPL4DBLIZSDf06bB4Av9NoojfYmLeqHzfvJVIu+faLo67lVx6CXj
mkmfqC6Q8vKmg8Ri/IdMi7/I75jJ7TIecpfB7T+z2U1Cs98Y9MMo2O1I6bhoWo5U
8l2axxTffcYWUU63kLY4zRskRT1HwXwn1M5XkO0efbnqDoksgIImpAGp+F1afkVA
RS5cUMe6yd0UCzXjRqApM+I8hZ1LKvSRZpiVTR6hFTzoBpQ6afuY13pudObiAJlz
zNA2pm+djtTeiS2jMZDO4kCa4v+xmCcgNPzPUgMT8faDdKVAjKw=
=t1jp
-----END PGP SIGNATURE-----