[SECURITY] [DLA 3294-1] libarchive security update

2023-01-3018:42:27

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.3%

JSON

Debian LTS Advisory DLA-3294-1 [email protected]
https://www.debian.org/lts/security/ Thorsten Alteholz
January 30, 2023 https://wiki.debian.org/LTS

Package : libarchive
Version : 3.3.3-4+deb10u3
CVE ID : CVE-2022-36227

An issue has been found in libarchive, a multi-format archive and
compression library.
Due to missing checks after calloc, null pointer dereferences might
happen.

For Debian 10 buster, this problem has been fixed in version
3.3.3-4+deb10u3.

We recommend that you upgrade your libarchive packages.

For the detailed security status of libarchive please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libarchive

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10amd64libarchive13< 3.3.3-4+deb10u3libarchive13_3.3.3-4+deb10u3_amd64.deb
Debian10arm64libarchive13< 3.3.3-4+deb10u3libarchive13_3.3.3-4+deb10u3_arm64.deb
Debian10i386libarchive13< 3.3.3-4+deb10u3libarchive13_3.3.3-4+deb10u3_i386.deb
Debian10i386libarchive-tools< 3.3.3-4+deb10u3libarchive-tools_3.3.3-4+deb10u3_i386.deb
Debian10arm64libarchive-dev< 3.3.3-4+deb10u3libarchive-dev_3.3.3-4+deb10u3_arm64.deb
Debian10amd64libarchive-dev< 3.3.3-4+deb10u3libarchive-dev_3.3.3-4+deb10u3_amd64.deb
Debian10armhflibarchive13< 3.3.3-4+deb10u3libarchive13_3.3.3-4+deb10u3_armhf.deb
Debian10allbsdtar< 3.3.3-4+deb10u3bsdtar_3.3.3-4+deb10u3_all.deb
Debian10armhflibarchive-tools< 3.3.3-4+deb10u3libarchive-tools_3.3.3-4+deb10u3_armhf.deb
Debian10alllibarchive< 3.3.3-4+deb10u3libarchive_3.3.3-4+deb10u3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	amd64	libarchive13	< 3.3.3-4+deb10u3	libarchive13_3.3.3-4+deb10u3_amd64.deb
Debian	10	arm64	libarchive13	< 3.3.3-4+deb10u3	libarchive13_3.3.3-4+deb10u3_arm64.deb
Debian	10	i386	libarchive13	< 3.3.3-4+deb10u3	libarchive13_3.3.3-4+deb10u3_i386.deb
Debian	10	i386	libarchive-tools	< 3.3.3-4+deb10u3	libarchive-tools_3.3.3-4+deb10u3_i386.deb
Debian	10	arm64	libarchive-dev	< 3.3.3-4+deb10u3	libarchive-dev_3.3.3-4+deb10u3_arm64.deb
Debian	10	amd64	libarchive-dev	< 3.3.3-4+deb10u3	libarchive-dev_3.3.3-4+deb10u3_amd64.deb
Debian	10	armhf	libarchive13	< 3.3.3-4+deb10u3	libarchive13_3.3.3-4+deb10u3_armhf.deb
Debian	10	all	bsdtar	< 3.3.3-4+deb10u3	bsdtar_3.3.3-4+deb10u3_all.deb
Debian	10	armhf	libarchive-tools	< 3.3.3-4+deb10u3	libarchive-tools_3.3.3-4+deb10u3_armhf.deb
Debian	10	all	libarchive	< 3.3.3-4+deb10u3	libarchive_3.3.3-4+deb10u3_all.deb