[SECURITY] [DLA 2987-1] libarchive security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2987-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Thorsten Alteholz
April 30, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : libarchive
Version : 3.2.2-2+deb9u3
CVE ID : CVE-2019-19221 CVE-2021-23177 CVE-2021-31566
Three issues have been found in libarchive, a multi-format archive and
compression library.
CVE-2021-31566
symbolic links incorrectly followed when changing modes, times, ACL
and flags of a file while extracting an archive
CVE-2021-23177
extracting a symlink with ACLs modifies ACLs of target
CVE-2019-19221
out-of-bounds read because of an incorrect mbrtowc or mbtowc call
For Debian 9 stretch, these problems have been fixed in version
3.2.2-2+deb9u3.
We recommend that you upgrade your libarchive packages.
For the detailed security status of libarchive please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libarchive
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmJttm9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEeFbg/8DUb5lPq+TOae8k2X0bFHmq3s1Cwv5Euz1biZYoTxGrXR2oLA49rwUamU
at/Ekp/2E7zhg0WBVS8hl+rLsEinap8aXzbEspzVFnTyxfbcwsXE4jcYkeS0mjLR
Xk3tLBp/fgasVAQqJit5xcDXivMKhiUkRjVT+fuxkwfz2gJf9pqla1svGPojFzX5
MsARZAfWDn5CQpmhAYysb8GrZwGjVSlBaHk7mgNT3ABBQBl9/s4+jCgktgnGgJ1c
RWE4iedHU6MJ2mBNG5P57iTKLtReOEhPrqSNe+T3lwwWmGb4eAhZRLjzrtvUMIRJ
Ir7ATZyzySRiPKGGBAMrUgxZEys4evjm3vi5KnQLsmjZlF2NcRcX70h+bIrzFiPD
r93KMm+nkxKzn3mPqaXcKYevPCtoG9yzDNH4VtVAy8DrK7ZBJVbPI1uP5+O4N8xB
y3VA0Y9GzUCQ3xkB/46tQbk16wKcMa/kUdrp/nCXbTEIJs7zazcBxhCwN2Mbzv6Z
eOs1Zvt/UQ4vCf7izZ2DuRMQgjMR/n6h2hK6a526zYCc22zxQ1RQX4KyD5SaFdBY
6PVS+apHNi8wYZ7rcq0Zrn7+tEdh2lBXGUPMd/NQnr2Wxct+9iKEN0Lp8sW4WEk6
e2qTuOKp6of2RsFrggsLBA92rZvGUQWkH5pX0tZwy+F1yrtr5ec=
=MyGA
-----END PGP SIGNATURE-----
Reply to: