Security update for libarchive

This update for libarchive fixes several issues.

These security issues were fixed:

- CVE-2016-8687: Buffer overflow when printing a filename (bsc#1005070).
- CVE-2016-8689: Heap overflow when reading corrupted 7Zip files (bsc#1005072).
- CVE-2016-8688: Use after free because of incorrect calculation in next_line (bsc#1005076).
- CVE-2016-5844: Integer overflow in the ISO parser in libarchive allowed remote attackers to cause a denial of service (application crash) via a crafted ISO file (bsc#986566).
- CVE-2016-6250: Integer overflow in the ISO9660 writer in libarchive allowed remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow (bsc#989980).
- CVE-2016-5418: The sandboxing code in libarchive mishandled hardlink archive entries of non-zero data size, which might allowed remote attackers to write to arbitrary files via a crafted archive file (bsc#998677).

This update was imported from the SUSE:SLE-12:Update update project.

Fixed bugs
bnc#986566
VUL-0: CVE-2016-5844: bsdtar,libarchive: undefined behaviour (integer overflow) in iso parser
bnc#1005070
VUL-0: CVE-2016-8687: bsdtar, libarchive: Buffer overflow printing a filename
bnc#1005072
VUL-0: CVE-2016-8689: libarchive: Heap overflow reading corrupted 7Zip files
bnc#989980
VUL-1: CVE-2016-6250: libarchive: Integer overflow when verifying filename size when writing ISO9660 archives
bnc#998677
VUL-0: CVE-2016-5418: libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite
bnc#1005076
VUL-0: CVE-2016-8688: libarchive: Use after free because of incorrect calculation in next_line
Selected Binaries
openSUSE Build Service is sponsored by