]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core-contrib.git/commit
libarchive: fix CVE-2025-5914
authorDivya Chellam <divya.chellam@windriver.com>
Wed, 2 Jul 2025 06:51:30 +0000 (12:21 +0530)
committerSteve Sakoman <steve@sakoman.com>
Thu, 3 Jul 2025 16:04:44 +0000 (09:04 -0700)
commitb7d8249bda296620a5bbf592f4cdf566b4537563
tree43f968f11a6ed734c1d8e8f9c0bb5fa0f811560e
parent175cd54fd57266d7dea07121861a4f15be00a882
libarchive: fix CVE-2025-5914

A vulnerability has been identified in the libarchive library, specifically within the archiv
e_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultim
ately lead to a double-free condition. Exploiting a double-free vulnerability can result in m
emory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service
condition.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-5914

Upstream-patch:
https://github.com/libarchive/libarchive/commit/09685126fcec664e2b8ca595e1fc371bd494d209

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-extended/libarchive/libarchive/CVE-2025-5914.patch [new file with mode: 0644]
meta/recipes-extended/libarchive/libarchive_3.7.9.bb