libarchive: upgrade 3.8.6 -> 3.8.7

Solves CVE-2026-5121 (points to [2] per [3]).
Since it's Redhat version-less CVE, add explicit CVE_STATUS.

Release information [1]:

Libarchive 3.8.6 is a security and bugfix release.

Notable fixes:

* CAB: fix NULL pointer dereference during skip (#2900)
* CAB: Fix Heap OOB Write in CAB LZX decoder (#2919)
* cpio: various fixes and improvements (#2899, #2908, #2910, #2939)
* contrib/untar: fix out-of-bounds read (#2903)
* iso9660: fix undefined behavior (#2897)
* iso9660: fix posibble heap buffer overflow on 32-bit systems (#2934)
* libarchive: fix handling of option failures (#2871)
* libarchive: do not continue with truncated numbers (#2911)
* libarchive: lzop and grzip filter support (#2947)
* RAR: fix LZSS window size mismatch after PPMd block (#2898)

[1] https://github.com/libarchive/libarchive/releases/tag/v3.8.7
[2] https://github.com/libarchive/libarchive/pull/2934
[3] https://security-tracker.debian.org/tracker/CVE-2026-5121

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.6.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
similarity index 95%
rename from meta/recipes-extended/libarchive/libarchive_3.8.6.bb
rename to meta/recipes-extended/libarchive/libarchive_3.8.7.bb
index d579cdb65a5d46be74db594f2923f5f15056f1bf..a65afb7b22db67ee1d3892ada4e4aa25d05cab8f 100644 (file)
--- a/meta/recipes-extended/libarchive/libarchive_3.8.6.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
@@ -34,7 +34,7 @@ SRC_URI = "https://libarchive.org/downloads/libarchive-${PV}.tar.gz \
           "
 UPSTREAM_CHECK_URI = "https://www.libarchive.org/"
 
-SRC_URI[sha256sum] = "213269b05aac957c98f6e944774bb438d0bd168a2ec60b9e4f8d92035925821c"
+SRC_URI[sha256sum] = "4b787cca6697a95c7725e45293c973c208cbdc71ae2279f30ef09f52472b9166"
 
 inherit autotools update-alternatives pkgconfig ptest
 
@@ -88,3 +88,5 @@ do_install_ptest() {
 }
 
 RDEPENDS:${PN}-ptest += "bsdtar bsdcpio"
+
+CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7"