mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

libarchive: handle CVE-2026-5121

Browse Source 
Cherry-pick patch for this CVE mentioned in [1].

Since the actual code change is already included in previous patch for
CVE-2026-4426, add reference to CVE-2026-5121 to that patch and keep the
remaining part (test) as CVE-2026-5121-02.patch.

[1] https://security-tracker.debian.org/tracker/CVE-2026-5121

(From OE-Core rev: 608a151948db9652b0e7032863bba1ed022a00aa)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Peter Marko
2026-08-23 14:42:12 +02:00
committed by Richard Purdie
parent 88843705b1
commit fd0ffc6666
3 changed files with 1273 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-extended/libarchive/libarchive/CVE-2026-4426.patch → meta/recipes-extended/libarchive/libarchive/CVE-2026-4426_CVE-2026-5121.patch
View File

@@ -21,6 +21,7 @@ decompression path from executing.
Found by fuzzing with ASAN/UBSAN.
CVE: CVE-2026-4426
CVE: CVE-2026-5121
Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/c3cb1c568ebf9e8f7f478cfc0356ae54e99712b0]
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---

1270
meta/recipes-extended/libarchive/libarchive/CVE-2026-5121-02.patch Normal file
View File

File diff suppressed because it is too large Load Diff

3
meta/recipes-extended/libarchive/libarchive_3.7.9.bb
View File

@@ -46,9 +46,10 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
file://CVE-2025-60753-02.patch \
file://CVE-2026-4111-1.patch \
file://CVE-2026-4111-2.patch \
file://CVE-2026-4426.patch \
file://CVE-2026-4426_CVE-2026-5121.patch \
file://CVE-2026-4424-1.patch \
file://CVE-2026-4424-2.patch \
file://CVE-2026-5121-02.patch \
"
UPSTREAM_CHECK_URI = "http://libarchive.org/"