diff --git a/SPECS/libarchive/CVE-2026-15028.patch b/SPECS/libarchive/CVE-2026-15028.patch new file mode 100644 index 00000000000..0d88bbe41eb --- /dev/null +++ b/SPECS/libarchive/CVE-2026-15028.patch @@ -0,0 +1,43 @@ +From 12292ac0095380fb26f74e110a7488cb10168f69 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libarchive/libarchive/pull/3252.patch +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index ecaf6c3..39759fc 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3244,13 +3244,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; +-- +2.45.4 + diff --git a/SPECS/libarchive/libarchive.spec b/SPECS/libarchive/libarchive.spec index b7f21510296..5d7ad5de7cc 100644 --- a/SPECS/libarchive/libarchive.spec +++ b/SPECS/libarchive/libarchive.spec @@ -1,7 +1,7 @@ Summary: Multi-format archive and compression library Name: libarchive Version: 3.7.7 -Release: 7%{?dist} +Release: 8%{?dist} # Certain files have individual licenses. For more details see contents of "COPYING". License: BSD AND Public Domain AND (ASL 2.0 OR CC0 1.0 OR OpenSSL) Vendor: Microsoft Corporation @@ -21,6 +21,7 @@ Patch9: CVE-2026-4424.patch Patch10: CVE-2026-4426.patch Patch11: CVE-2026-5121.patch Patch12: CVE-2026-14164.patch +Patch13: CVE-2026-15028.patch Provides: bsdtar = %{version}-%{release} BuildRequires: xz-libs @@ -78,6 +79,9 @@ make %{?_smp_mflags} check %{_libdir}/pkgconfig/*.pc %changelog +* Wed Jul 15 2026 Azure Linux Security Servicing Account - 3.7.7-8 +- Patch for CVE-2026-15028 + * Fri Jul 03 2026 Azure Linux Security Servicing Account - 3.7.7-7 - Patch for CVE-2026-14164 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 91f472d3e12..5fdbc0c58b8 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -178,8 +178,8 @@ openssl-static-3.3.7-3.azl3.aarch64.rpm libcap-2.69-15.azl3.aarch64.rpm libcap-devel-2.69-15.azl3.aarch64.rpm debugedit-5.0-2.azl3.aarch64.rpm -libarchive-3.7.7-7.azl3.aarch64.rpm -libarchive-devel-3.7.7-7.azl3.aarch64.rpm +libarchive-3.7.7-8.azl3.aarch64.rpm +libarchive-devel-3.7.7-8.azl3.aarch64.rpm rpm-4.18.2-1.azl3.aarch64.rpm rpm-build-4.18.2-1.azl3.aarch64.rpm rpm-build-libs-4.18.2-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index b766df23305..b69a17c8d35 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -178,8 +178,8 @@ openssl-static-3.3.7-3.azl3.x86_64.rpm libcap-2.69-15.azl3.x86_64.rpm libcap-devel-2.69-15.azl3.x86_64.rpm debugedit-5.0-2.azl3.x86_64.rpm -libarchive-3.7.7-7.azl3.x86_64.rpm -libarchive-devel-3.7.7-7.azl3.x86_64.rpm +libarchive-3.7.7-8.azl3.x86_64.rpm +libarchive-devel-3.7.7-8.azl3.x86_64.rpm rpm-4.18.2-1.azl3.x86_64.rpm rpm-build-4.18.2-1.azl3.x86_64.rpm rpm-build-libs-4.18.2-1.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 899ed1aa0e4..329f02dd1d8 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -168,9 +168,9 @@ krb5-devel-1.21.3-5.azl3.aarch64.rpm krb5-lang-1.21.3-5.azl3.aarch64.rpm libacl-2.4.0-1.azl3.aarch64.rpm libacl-devel-2.4.0-1.azl3.aarch64.rpm -libarchive-3.7.7-7.azl3.aarch64.rpm -libarchive-debuginfo-3.7.7-7.azl3.aarch64.rpm -libarchive-devel-3.7.7-7.azl3.aarch64.rpm +libarchive-3.7.7-8.azl3.aarch64.rpm +libarchive-debuginfo-3.7.7-8.azl3.aarch64.rpm +libarchive-devel-3.7.7-8.azl3.aarch64.rpm libassuan-2.5.6-1.azl3.aarch64.rpm libassuan-debuginfo-2.5.6-1.azl3.aarch64.rpm libassuan-devel-2.5.6-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 0748ab677d8..8e98c021228 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -176,9 +176,9 @@ krb5-devel-1.21.3-5.azl3.x86_64.rpm krb5-lang-1.21.3-5.azl3.x86_64.rpm libacl-2.4.0-1.azl3.x86_64.rpm libacl-devel-2.4.0-1.azl3.x86_64.rpm -libarchive-3.7.7-7.azl3.x86_64.rpm -libarchive-debuginfo-3.7.7-7.azl3.x86_64.rpm -libarchive-devel-3.7.7-7.azl3.x86_64.rpm +libarchive-3.7.7-8.azl3.x86_64.rpm +libarchive-debuginfo-3.7.7-8.azl3.x86_64.rpm +libarchive-devel-3.7.7-8.azl3.x86_64.rpm libassuan-2.5.6-1.azl3.x86_64.rpm libassuan-debuginfo-2.5.6-1.azl3.x86_64.rpm libassuan-devel-2.5.6-1.azl3.x86_64.rpm