Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP4:Update
libarchive.26538
libarchive.changes
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File libarchive.changes of Package libarchive.26538
------------------------------------------------------------------- Fri Oct 21 10:02:49 UTC 2022 - Danilo Spinella <danilo.spinella@suse.com> - Fix CVE-2021-31566, modifies file flags of symlink target (CVE-2021-31566, bsc#1192426.patch) CVE-2021-31566.patch - Fix bsc#1192427, processing fixup entries may follow symbolic links bsc1192427.patch ------------------------------------------------------------------- Mon Sep 12 13:57:09 UTC 2022 - Danilo Spinella <danilo.spinella@suse.com> - Fix CVE-2021-23177, extracting a symlink with ACLs modifies ACLs of target (CVE-2021-23177, bsc#1192425) * CVE-2021-23177.patch ------------------------------------------------------------------- Tue May 10 16:25:11 UTC 2022 - Danilo Spinella <danilo.spinella@suse.com> - Fix CVE-2022-26280 out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280, bsc#1197634) * fix-CVE-2022-26280.patch ------------------------------------------------------------------- Mon Mar 14 14:26:18 UTC 2022 - Danilo Spinella <danilo.spinella@suse.com> - Fix CVE-2021-36976 use-after-free in copy_string (CVE-2021-36976, bsc#1188572) * fix-CVE-2021-36976.patch - The following issues have already been fixed in this package but weren't previously mentioned in the changes file: CVE-2017-5601, bsc#1022528, bsc#1189528 ------------------------------------------------------------------- Tue Feb 18 14:46:07 UTC 2020 - Ismail Dönmez <idonmez@suse.com> - Switch back to cmake build now that cmake-mini exists, this will no longer create a build-cycle. ------------------------------------------------------------------- Wed Feb 12 08:34:50 UTC 2020 - Ismail Dönmez <idonmez@suse.com> - Update to version 3.4.2 New features: * support for atomic file extraction (bsdtar -x --safe-writes) (#1289) * support for mbed TLS (PolarSSL) (#1301) Important bugfixes: * security fixes in RAR5 reader (#1280 #1326) * compression buffer fix in XAR writer (#1317) * fix uname and gname longer than 32 characters in PAX writer (#1319) * fix segfault when archiving hard links in ISO9660 and XAR writers (#1325) * fix support for extracting 7z archive entries with Delta filter (#987) ------------------------------------------------------------------- Mon Dec 30 08:40:05 UTC 2019 - Ismail Dönmez <idonmez@suse.com> - Revert back to autoconf, cmake introduces a cycle. Leave cmake patches in since they are basically correct and might be useful in the future. ------------------------------------------------------------------- Mon Dec 30 08:14:13 UTC 2019 - Ismail Dönmez <idonmez@suse.com> - Update to version 3.4.1 New features: * Unicode filename support for reading lha/lzh archives * New pax write option "xattrhdr" Important bugfixes: * security fixes in wide string processing (#1276 #1298) * security fixes in RAR5 reader (#1212 #1217 #1296) CVE-2019-19221 * security fixes and optimizations to write filter logic (#351) * security fix related to use of readlink(2) (1dae5a5) * sparse file handling fixes (#1218 #1260) - Drop CVE-2019-19221.patch and fix-zstd-test.patch, fixed upstream ------------------------------------------------------------------- Fri Nov 22 13:17:53 UTC 2019 - Adrian Schröter <adrian@suse.de> - fix bsc#1157569 CVE-2019-19221.patch out-of-bounds read in libarchive ------------------------------------------------------------------- Sun Aug 18 12:33:05 UTC 2019 - Ismail Dönmez <idonmez@suse.com> - Switch to cmake build - Add lib-suffix.patch to honor LIB_SUFFIX - Add fix-zstd-test.patch to fix zstd test - Add fix-soversion.patch to fix the soversion to 13 as autotools ------------------------------------------------------------------- Thu Jun 20 11:35:15 UTC 2019 - Ismail Dönmez <idonmez@suse.com> - Add lz4 and zstd support - Add BuildRequires on liblz4-devel and libzstd-devel ------------------------------------------------------------------- Thu Jun 13 08:00:36 UTC 2019 - Ismail Dönmez <idonmez@suse.com> - Update to version 3.4.0 * Support for file and directory symlinks on Windows * Read support for RAR 5.0 archives * Read support for ZIPX archives with xz, lzma, ppmd8 and bzip2 compression * Support for non-recursive list and extract * New tar option: --exclude-vcs * Improved file attribute support on Linux and file flags support on FreeBSD * Fix reading Android APK archives (#1055 ) * Fix problems related to unreadable directories (#1167) * A two-digit number of OSS-Fuzz issues was resolved in this release including CVE-2019-18408 - Add libarchive.keyring and validate the tarball signature - Drop all security patches, fixed upstream: * CVE-2018-1000877.patch * CVE-2018-1000878.patch * CVE-2018-1000879.patch * CVE-2018-1000880.patch * CVE-2019-1000019.patch * CVE-2019-1000020.patch ------------------------------------------------------------------- Tue Feb 5 15:16:08 UTC 2019 - Adrian Schröter <adrian@suse.de> - Added patches: * CVE-2019-1000019.patch Fixes 7zip crash (boo#1124341) * CVE-2019-1000020.patch ISO9660 infinite loop fixed (boo#1124342) ------------------------------------------------------------------- Thu Jan 3 15:26:58 UTC 2019 - Karol Babioch <kbabioch@suse.de> - Added patches: * CVE-2018-1000877.patch, which fixes a double free vulnerability in RAR decoder (CVE-2018-1000877 bsc#1120653) * CVE-2018-1000878.patch, which fixes a Use-After-Free vulnerability in RAR decoder (CVE-2018-1000878 bsc#1120654) * CVE-2018-1000879.patch, which fixes a NULL Pointer Dereference vulnerability in ACL parser (CVE-2018-1000879 bsc#1120656) * CVE-2018-1000880.patch, which fixes an improper input validation vulnerability in WARC parser (CVE-2018-1000880 bsc#1120659) - Make use of %license macro - Applied spec-cleaner ------------------------------------------------------------------- Tue Sep 18 07:08:54 UTC 2018 - Jan Engelhardt <jengelh@inai.de> - Fix RPM groups. Remove idempotent %if..%endif guards. Diversify summaries. Set CFLAGS instead of re-defining optflags with itself. ------------------------------------------------------------------- Fri Sep 14 06:57:14 UTC 2018 - Adrian Schröter <adrian@suse.de> - update to version 3.3.3 * Avoid super-linear slowdown on malformed mtree files * Many fixes for building with Visual Studio * NO_OVERWRITE doesn't change existing directory attributes * New support for Zstandard read and write filters - Fixes CVE-2017-14501, CVE-2017-14502, CVE-2017-14503 - fix-CVE-2017-14166.patch is obsolete ------------------------------------------------------------------- Thu Sep 7 07:05:15 UTC 2017 - adrian@suse.de - update to version 3.3.2 * NFSv4 ACL support for Linux (librichacl) - fix-CVE-2017-14166.patch (boo#1057514) ------------------------------------------------------------------- Mon Apr 3 14:44:27 UTC 2017 - adrian@suse.de - update to version 3.3.1 * Security & Feature release Details are not documented from upstream yet fix-extract-over-links.patch and libarchive-openssl.patch obsoleted ------------------------------------------------------------------- Fri Dec 2 13:37:54 UTC 2016 - adrian@suse.com - fix extracting over symlinks: fix-extract-over-links.patch the problem is solved upstream different, but git master is too different atm. ------------------------------------------------------------------- Wed Oct 26 09:27:32 UTC 2016 - adrian@suse.com - update to version 3.2.2 Unspecified security fixes, but at least: * CVE-2016-8687 * CVE-2016-8689 * CVE-2016-8688 * CVE-2016-5844 * CVE-2016-6250 * CVE-2016-5418 - obsoletes fix-build.patch ------------------------------------------------------------------- Sat Jul 23 21:13:34 UTC 2016 - dmueller@suse.com - make bsdtar require a matching libarchive version to avoid missing symbol errors ------------------------------------------------------------------- Mon Jun 20 10:31:43 UTC 2016 - adrian@suse.de - update to version 3.2.1 Fixes a number of security issues: CVE-2015-8934, CVE-2015-8933, CVE-2015-8917, CVE-2016-4301, CVE-2016-4300 - and fixing the build (fix-build.patch) ------------------------------------------------------------------- Thu Jun 16 09:33:17 UTC 2016 - adrian@suse.de - limit size of symlinks in cpio archives (CVE-2016-4809, boo#984990) CVE-2016-4809.patch ------------------------------------------------------------------- Mon May 9 08:42:19 UTC 2016 - adrian@suse.de - 4GB _constraints for ppc64le only, it would break other archs - update to version 3.2.0 * Fixes CVE-2016-1541 * Fixes CVE-2015-8928 * changes are only documented in git history * updated openssl patch * new bsdcat utility - removed obsolete patches for: * CVE-2013-0211.patch * directory-traversal-fix.patch * libarchive-xattr.patch ------------------------------------------------------------------- Fri May 6 14:45:14 UTC 2016 - normand@linux.vnet.ibm.com - add _constraints memory 4096MB to avoid ppc64le build failure ------------------------------------------------------------------- Sat Sep 19 20:17:41 UTC 2015 - astieger@suse.com - build static lib on RHEL 7 ------------------------------------------------------------------- Sun Mar 22 19:51:10 UTC 2015 - astieger@suse.com - RHEL/CentOS build fix, skipping autoreconf ------------------------------------------------------------------- Sun Mar 15 20:11:00 UTC 2015 - astieger@suse.com - add CVE for previous change ------------------------------------------------------------------- Thu Mar 5 13:36:09 UTC 2015 - adrian@suse.com - fix a directory traversal in cpio tool (bnc#920870) directory-traversal-fix.patch CVE-2015-2304 ------------------------------------------------------------------- Tue Nov 11 12:07:46 UTC 2014 - jsegitz@novell.com - Added CVE-2013-0211.patch to fix CVE-2013-0211 (bnc#800024) ------------------------------------------------------------------- Wed May 28 17:18:59 UTC 2014 - crrodriguez@opensuse.org - libarchive-xattr.patch, fix subtle wrong library check that causes this package to depend on libattr when it should be using glibc. ------------------------------------------------------------------- Sun Nov 24 16:22:02 UTC 2013 - andreas.stieger@gmx.de - add optional -static-devel library package, intended to publish pixz for CentOS / RHEL, default off - skip some dependencies not required for pixz on CentOS / RHEL ------------------------------------------------------------------- Tue Aug 20 05:34:09 UTC 2013 - crrodriguez@opensuse.org - remove artificial dependencies on libacl-devel, libbz2-devel, zlib-devel from libarchive-devel. ------------------------------------------------------------------- Mon Aug 19 21:14:38 UTC 2013 - crrodriguez@opensuse.org - libarchive-openssl.patch: Call OPENSSL_config where needed, otherwise on systems configured to use openSSL engines such as via-padlock wont benefit from hardware acceleration. ------------------------------------------------------------------- Fri Aug 16 20:07:27 UTC 2013 - andreas.stieger@gmx.de - update to 3.1.2 This is a maintenance update to fix issues with the new RAR seeking feature. - libarchive's new website moved to http://www.libarchive.org. ------------------------------------------------------------------- Sun Jun 16 23:59:28 UTC 2013 - jengelh@inai.de - Explicitly list libattr-devel as BuildRequires (and sort those) ------------------------------------------------------------------- Wed Feb 13 08:05:35 UTC 2013 - werner@suse.de - Use %libname macro to be consistent throughout the spec file ------------------------------------------------------------------- Tue Feb 5 18:48:08 UTC 2013 - p.drouand@gmail.com - Update to version 3.1.1: + Fix an issue with the soname versioning in builds of libarchive using cmake - Removed patchs; fixed and merged on upstream release: * libarchive-fix-checks.patch * libarchive-ppc64.patch - The soname has changed and pass to 13. ------------------------------------------------------------------- Thu Aug 23 08:30:05 UTC 2012 - dvaleev@suse.com - libarchive-ppc64.patch: fix http://code.google.com/p/libarchive/issues/detail?id=277 test_option_b and test_option_nodump are failing on ppc64 ------------------------------------------------------------------- Thu Aug 9 09:05:01 UTC 2012 - cfarrell@suse.com - license update: BSD-2-Clause The COPYING file shows that the package is predominantly BSD-2-Clause licensed ------------------------------------------------------------------- Tue Aug 7 18:47:14 UTC 2012 - dimstar@opensuse.org - Update to version 3.0.4: + libarchive development moved to http://libarchive.github.com/ - Changes from version 3.0.2: + Various fixes merged from FreeBSD + Symlink support in Zip reader and writer + Robustness fixes to 7Zip reader - Changes from version 3.0.1b: + 7Zip reader + Small fixes to ISO and Zip to improve robustness with corrupted input + Improve streaming Zip reader's support for uncompressed entries + New seeking Zip reader supports SFX Zip archives + Build fixes on Windows - For more changes since 2.8.5, please see NEWS file - Update URL Tag to represent new home of the project. - Rename libarchive2 to libarchive12, following upstreams soname bumps. - Add libarchive-fix-checks.patch: Fix gcc 4.7 side effects. - Drop libarchive-test-fuzz.patch: fixed upstream. - Drop libarchive-ignore-sigpipe-in-test-suite.patch: fixed upstream. - Drop libarchive-2.5.5_handle_ENOSYS_from_lutimes.patch: upstream rejected the patch. Seems to be too theoretical problem. ------------------------------------------------------------------- Mon May 7 08:35:39 UTC 2012 - werner@suse.de - Enforce usage of reentrant versions of libc functions ------------------------------------------------------------------- Mon Feb 13 18:19:49 UTC 2012 - dvaleev@suse.com - fix failed tests on ppc ------------------------------------------------------------------- Wed Feb 8 10:57:45 UTC 2012 - idonmez@suse.com - Use %makeinstall to be SLES compatible ------------------------------------------------------------------- Thu Dec 22 11:27:05 UTC 2011 - werner@suse.de - For SLES11 work around missing rpm macro ------------------------------------------------------------------- Tue Dec 6 16:00:48 UTC 2011 - coolo@suse.com - rename main package to libarchive ------------------------------------------------------------------- Tue Dec 6 16:00:32 UTC 2011 - coolo@suse.com - Update to libarchive 2.8.5 (from werner) * Fix issue 134: Improve handling of open failures * Fix issue 119: Relax ISO verification * Fix issue 121: mtree parsing * Fix extraction of GNU tar 'D' directory entries * Be less demanding in LZMA/XZ compression tests ------------------------------------------------------------------- Fri Sep 30 08:15:50 UTC 2011 - coolo@suse.com - add baselibs.conf for PackageKit to use ------------------------------------------------------------------- Tue Apr 19 13:23:09 UTC 2011 - idoenmez@novell.com - Add suport for xz and xar archives - Add libarchive-2.8.4-iso9660-data-types.patch: fix ISO9660 reader data type mismatches ------------------------------------------------------------------- Thu Nov 11 13:36:59 UTC 2010 - puzel@novell.com - udpate to libarchive-2.8.4 - see /usr/share/doc/packages/libarchive2/NEWS for changes - drop libarchive-2.5.5_fix_testsuite.patch (upstream) - update libarchive-2.5.5_handle_ENOSYS_from_lutimes.patch - clean up specfile - disable make check for now ------------------------------------------------------------------- Wed Jan 6 04:36:37 UTC 2010 - jengelh@medozas.de - enable parallel building ------------------------------------------------------------------- Wed Oct 29 17:24:49 CET 2008 - mrueckert@suse.de - added libarchive-2.5.5_handle_ENOSYS_from_lutimes.patch: it can happen that your system at build times supports lutimes but later at runtime the needed syscall is missing. ------------------------------------------------------------------- Mon Sep 8 17:57:29 CEST 2008 - mrueckert@suse.de - fix rm calls in %install ------------------------------------------------------------------- Sat Sep 6 17:54:11 CEST 2008 - mrueckert@suse.de - update to 2.5.5 This is a major version bump again: it incorporates lots of bugfixes and improvements. For all the details please see /usr/share/doc/packages/libarchive2/NEWS - drop the .la file - dropped patch libarchive-2.2.5_rpath.patch: no longer needed - added libarchive-2.5.5_fix_testsuite.patch: added missing mode to open() with O_CREAT ------------------------------------------------------------------- Wed Aug 15 12:58:06 CEST 2007 - ro@suse.de - fix dependency of devel package ------------------------------------------------------------------- Tue Aug 7 16:47:22 CEST 2007 - mrueckert@suse.de - restructured package: bsdtar is now the main package and libarchive2 and libarchive-devel the subpackages. This saves us a rename on soversion bumps. ------------------------------------------------------------------- Mon Jul 30 14:31:32 CEST 2007 - mrueckert@suse.de - update to 2.2.5 (#291358) This is a major version bump. For a full list of all changes see /usr/share/doc/packages/libarchive/NEWS. Mostly notable this up- date includes the fixes for the following security bugs: Errors handling corrupt tar files in libarchive (CVE-2007-3641, CVE-2007-3644, CVE-2007-3645) - added libarchive-2.2.5_rpath.patch: dont set a rpath on the builddir. - no longer building the static lib ------------------------------------------------------------------- Fri Jun 8 01:35:37 CEST 2007 - ro@suse.de - added ldconfig to post scripts - remove minitar objects (leave binary there for now) ------------------------------------------------------------------- Sun Apr 8 20:53:59 CEST 2007 - mrueckert@suse.de - updated to 2.0.28 - removed all patches: included upstream ------------------------------------------------------------------- Sat Mar 24 20:07:04 CET 2007 - mrueckert@suse.de - require libbz2-devel on >= 10.3 ------------------------------------------------------------------- Sat Mar 24 16:30:08 CET 2007 - aj@suse.de - Change requires for libbz2 split. ------------------------------------------------------------------- Tue Mar 6 16:49:29 CET 2007 - mrueckert@suse.de - updated bsdtar-1.2.53_ext2_include.patch: the old fix was not complete and on newer glibc/kernel-headers it seems you need to include linux/fs.h explicitly new name: bsdtar-1.3.1_linux_fs_includes.patch - build with -fno-strict-aliasing ------------------------------------------------------------------- Fri Nov 10 13:01:38 CET 2006 - mrueckert@suse.de - added SA-06-24_libarchive.patch: fix DOS in libarchive (CVE-2006-5680) http://security.freebsd.org/advisories/FreeBSD-SA-06:24.libarchive.asc ------------------------------------------------------------------- Fri Sep 22 13:03:42 CET 2006 - mrueckert@suse.de - update to version 1.3.1 ------------------------------------------------------------------- Thu Apr 27 02:32:57 CEST 2006 - mrueckert@suse.de - updated to 1.2.53: Upstream merged the source tarball. Splitted of a bsdtar package ------------------------------------------------------------------- Mon Feb 27 19:24:00 CET 2006 - mrueckert@suse.de - fixed building of debuginfo package ------------------------------------------------------------------- Mon Feb 27 18:32:04 CET 2006 - mrueckert@suse.de - libarchive 1.2.38
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
