Debian alert DLA-2987-1 (libarchive)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 2987-1] libarchive security update
Date:
             
 
Sat, 30 Apr 2022 22:21:35 +0000
Message-ID:
             
 
<alpine.DEB.2.21.2204302220280.21064@postfach.intern.alteholz.me>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2987-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
April 30, 2022                                https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libarchive
Version        : 3.2.2-2+deb9u3
CVE ID         : CVE-2019-19221 CVE-2021-23177 CVE-2021-31566


Three issues have been found in libarchive, a multi-format archive and 
compression library.

CVE-2021-31566
      symbolic links incorrectly followed when changing modes, times, ACL
      and flags of a file while extracting an archive

CVE-2021-23177
      extracting a symlink with ACLs modifies ACLs of target

CVE-2019-19221
      out-of-bounds read because of an incorrect mbrtowc or mbtowc call


For Debian 9 stretch, these problems have been fixed in version
3.2.2-2+deb9u3.

We recommend that you upgrade your libarchive packages.

For the detailed security status of libarchive please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libarchive

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmJttm9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEeFbg/8DUb5lPq+TOae8k2X0bFHmq3s1Cwv5Euz1biZYoTxGrXR2oLA49rwUamU
at/Ekp/2E7zhg0WBVS8hl+rLsEinap8aXzbEspzVFnTyxfbcwsXE4jcYkeS0mjLR
Xk3tLBp/fgasVAQqJit5xcDXivMKhiUkRjVT+fuxkwfz2gJf9pqla1svGPojFzX5
MsARZAfWDn5CQpmhAYysb8GrZwGjVSlBaHk7mgNT3ABBQBl9/s4+jCgktgnGgJ1c
RWE4iedHU6MJ2mBNG5P57iTKLtReOEhPrqSNe+T3lwwWmGb4eAhZRLjzrtvUMIRJ
Ir7ATZyzySRiPKGGBAMrUgxZEys4evjm3vi5KnQLsmjZlF2NcRcX70h+bIrzFiPD
r93KMm+nkxKzn3mPqaXcKYevPCtoG9yzDNH4VtVAy8DrK7ZBJVbPI1uP5+O4N8xB
y3VA0Y9GzUCQ3xkB/46tQbk16wKcMa/kUdrp/nCXbTEIJs7zazcBxhCwN2Mbzv6Z
eOs1Zvt/UQ4vCf7izZ2DuRMQgjMR/n6h2hK6a526zYCc22zxQ1RQX4KyD5SaFdBY
6PVS+apHNi8wYZ7rcq0Zrn7+tEdh2lBXGUPMd/NQnr2Wxct+9iKEN0Lp8sW4WEk6
e2qTuOKp6of2RsFrggsLBA92rZvGUQWkH5pX0tZwy+F1yrtr5ec=
=MyGA
-----END PGP SIGNATURE-----