fix(cve): CVE-2026-15028 - 兼容性适配修改 - #19
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/hold |
|
TAG Bot TAG: 3.7.4-4+deb13u1deepin5 |
|
/test github-trigger-obs-ci |
…ze checks CVE: CVE-2026-16517 (unknown) - A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows Upstream: libarchive/libarchive@4bb52f4 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-16517 - 兼容性适配修改：添加 archive_integer.h 头文件以支持 CVE 修复 patch 中的 archive_ckd_add_i64() 函数调用。原始 CVE patch 仅修改了 archive_write_set_format_zip.c，添加了 #include archive_integer.h 和函数调用，但基线代码缺少此头文件，导致编译失败。从上游仓库复制 archive_integer.h 到 libarchive/ 目录解决此问题。 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
3b098f5 to
2b7184d
Compare
|
/integrate |
1 similar comment
|
/integrate |
|
AutoIntegrationPr Bot |
…uwu/tar-fix-oob CVE: CVE-2026-15028 (unknown) - A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could cause a denial of service or potentially execute arbitrary code. Upstream: libarchive/libarchive@ffc1114 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
2 participants
CVE: CVE-2026-16517 - 兼容性适配修改：添加 archive_integer.h 头文件以支持 CVE 修复 patch 中的 archive_ckd_add_i64() 函数调用。原始 CVE patch 仅修改了 archive_write_set_format_zip.c，添加了 #include archive_integer.h 和函数调用，但基线代码缺少此头文件，导致编译失败。从上游仓库复制 archive_integer.h 到 libarchive/ 目录解决此问题。
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-15028 (unknown) - A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could cause a denial of service or potentially execute arbitrary code.
Upstream: libarchive/libarchive@ffc1114
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b