USN-7070-1: libarchive vulnerabilities

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• libarchive - Library to read/write archive files

Details

It was discovered that libarchive mishandled certain memory checks,
which could result in a NULL pointer dereference. An attacker could
potentially use this issue to cause a denial of service. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-36227)

It was discovered that libarchive mishandled certain memory operations,
which could result in an out-of-bounds memory access. An attacker could
potentially use this issue to cause a denial of service. This issue only
affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-48957, CVE-2024-48958)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• libarchive13t64 - 3.7.2-2ubuntu0.2

Ubuntu 22.04

• libarchive13 - 3.6.0-1ubuntu1.2

Ubuntu 20.04

• libarchive13 - 3.4.0-2ubuntu1.3

Ubuntu 18.04

• libarchive13 - 3.2.2-3.1ubuntu0.7+esm1
  Available with Ubuntu Pro

Ubuntu 16.04

• libarchive13 - 3.1.2-11ubuntu0.16.04.8+esm1
  Available with Ubuntu Pro

Ubuntu 14.04

• libarchive13 - 3.1.2-7ubuntu2.8+esm3
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-48958
• CVE-2024-48957
• CVE-2022-36227