diff --git a/backport-CVE-2024-20697-CVE-2024-26256.patch b/backport-CVE-2024-20697-CVE-2024-26256.patch deleted file mode 100644 index 9eeead106fbeaab65dadc15bd70f284cc45923cd..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-20697-CVE-2024-26256.patch +++ /dev/null @@ -1,23 +0,0 @@ -From eb7939b24a681a04648a59cdebd386b1e9dc9237 Mon Sep 17 00:00:00 2001 -From: Wei-Cheng Pan -Date: Mon, 22 Apr 2024 01:55:41 +0900 -Subject: [PATCH] fix: OOB in rar e8 filter (#2135) - -This patch fixes an out-of-bound error in rar e8 filter. ---- - libarchive/archive_read_support_format_rar.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c -index 99a11d1700..266d0ee995 100644 ---- a/libarchive/archive_read_support_format_rar.c -+++ b/libarchive/archive_read_support_format_rar.c -@@ -3615,7 +3615,7 @@ execute_filter_e8(struct rar_filter *filter, struct rar_virtual_machine *vm, siz - uint32_t filesize = 0x1000000; - uint32_t i; - -- if (length > PROGRAM_WORK_SIZE || length < 4) -+ if (length > PROGRAM_WORK_SIZE || length <= 4) - return 0; - - for (i = 0; i <= length - 5; i++) diff --git a/libarchive-3.7.1.tar.gz b/libarchive-3.7.4.tar.gz similarity index 49% rename from libarchive-3.7.1.tar.gz rename to libarchive-3.7.4.tar.gz index 922b6c729d391c010ffa6228134c164886bac0f1..50abf77b7226df46a33013f278464c1588b0ceea 100644 Binary files a/libarchive-3.7.1.tar.gz and b/libarchive-3.7.4.tar.gz differ diff --git a/libarchive.spec b/libarchive.spec index 4782ee5b8bba452609c88e6671f7e2d0d0d0e589..44eef0f4d4936c33e06a90b886aeb44c51f1c197 100644 --- a/libarchive.spec +++ b/libarchive.spec @@ -1,15 +1,14 @@ %bcond_without check Name: libarchive -Version: 3.7.1 -Release: 3 +Version: 3.7.4 +Release: 1 Summary: Multi-format archive and compression library License: BSD URL: https://www.libarchive.org/ Source0: https://libarchive.org/downloads/%{name}-%{version}.tar.gz -Patch6000: backport-CVE-2024-20697-CVE-2024-26256.patch -Patch6001: backport-CVE-2024-20696.patch +Patch6000: backport-CVE-2024-20696.patch BuildRequires: gcc bison sharutils zlib-devel bzip2-devel xz-devel BuildRequires: lzo-devel e2fsprogs-devel libacl-devel libattr-devel @@ -112,6 +111,7 @@ do done %check +export LC_ALL=en_US.UTF-8 %if %{with check} logfiles () { @@ -201,6 +201,12 @@ run_testsuite %{_mandir}/*/bsdunzip* %changelog +* Sun Jul 28 2024 dillon chen - 3.7.4-1 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:Upgrade to 3.7.4 + * Thu Jun 06 2024 lingsheng - 3.7.1-3 - Type:CVE - ID:CVE-2024-20696