All errata/sisyphus/ALT-PU-2022-1454-1
ALT-PU-2022-1454-1

Package update libarchive in branch sisyphus

Version3.6.0-alt1
Task#296421
Published2022-03-09
Max severityHIGH
Severity:

Closed issues (6)

BDU:2021-03887
MEDIUM6.5

Уязвимость функции do_uncompress_block and process_block библиотеки libarchive, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2021-08-03Modified: 2023-11-13
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.1
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:C
References
BDU:2022-01463
HIGH7.3

Уязвимость библиотеки архивирования libarchive, связанная с отслеживанием символьных ссылок, позволяющая нарушителю повысить свои привилегии

Published: 2022-03-25Modified: 2025-09-05
CVSS 3.xHIGH 7.3
CVSS:3.x/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2022-01464
HIGH7.3

Уязвимость библиотеки архивирования libarchive, связанная с отслеживанием символьных ссылок, позволяющая нарушителю повысить свои привилегии

Published: 2022-03-25Modified: 2025-09-05
CVSS 3.xHIGH 7.3
CVSS:3.x/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:C
References
CVE-2021-23177
HIGH7.8

An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to change the ACL of a file on the system and gain more privileges.

Published: 2022-08-23Modified: 2024-11-21
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
CVE-2021-31566
HIGH7.8

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

Published: 2022-08-23Modified: 2024-11-21
CVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
CVE-2021-36976
MEDIUM6.5

libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).

Published: 2021-07-20Modified: 2025-11-03
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References