mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-24 22:36:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

libarchive: mark CVE-2026-14164 as fixed-version

Browse Source 
The RAR5 double-free in init_unpack() is a regression introduced
upstream by commit 620bdafa on 2026-05-16 and existed only
on the git master branch until it was fixed by PR #3071 (commit
1c914cdf) on 2026-05-24. It was never part of an upstream release.

The upstream release tarballs (3.6.x/3.7.x/3.8.6) use the older
init_unpack() with unchecked calloc and no early-return path, so the
freed window_buf/filtered_buf pointers are never left dangling and the
double-free cannot occur.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-14164
  https://lore.kernel.org/openembedded-core/0447ebc9d29b0736de8ba0c75f155ed4f880d072.camel@pbarker.dev/

(From OE-Core rev: 6bc3e86bab4af0762400cb86f0b6932d6fa50433)

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Daniel Turull
2026-09-04 14:16:00 +02:00
committed by Paul Barker
parent c77dc0dfc3
commit 8ed647830e
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
meta/recipes-extended/libarchive/libarchive_3.7.9.bb
View File

@@ -84,3 +84,8 @@ ALTERNATIVE_LINK_NAME[cpio] = "${base_bindir}/cpio"
ALTERNATIVE_TARGET[cpio] = "${bindir}/bsdcpio"
BBCLASSEXTEND = "native nativesdk"
CVE_STATUS[CVE-2026-14164] = "fixed-version: Double-free regression in the RAR5\
reader's init_unpack() was introduced upstream by commit 620bdafa (2026-05-16) and existed\
only on the git master branch until the fix in PR #3071 (commit 1c914cdf, 2026-05-24). It was\
never part of an upstream release tarball."