CVE-2022-26280

Name	CVE-2022-26280
Description	Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3950-1
Debian Bugs	1008953

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libarchive (PTS)	jessie, jessie (lts)	3.1.2-11+deb8u12	fixed
	stretch (security)	3.2.2-2+deb9u3	fixed
	stretch (lts), stretch	3.2.2-2+deb9u5	fixed
	buster, buster (lts)	3.3.3-4+deb10u4	fixed
	buster (security)	3.3.3-4+deb10u3	fixed
	bullseye	3.4.3-2+deb11u1	vulnerable
	bullseye (security)	3.4.3-2+deb11u2	fixed
	bookworm	3.6.2-1+deb12u1	fixed
	bookworm (security)	3.6.2-1+deb12u2	fixed
	sid, trixie	3.7.4-1.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libarchive	source	jessie	(not affected)
libarchive	source	stretch	(not affected)
libarchive	source	buster	(not affected)
libarchive	source	bullseye	3.4.3-2+deb11u2	DLA-3950-1
libarchive	source	(unstable)	3.6.2-1		1008953

Notes

[buster] - libarchive <not-affected> (Vulnerable code not present)
[stretch] - libarchive <not-affected> (Vulnerable code not present)
https://github.com/libarchive/libarchive/issues/1672
Introduced by: https://github.com/libarchive/libarchive/commit/121035c83e18b70d3128e9ac966109ebedb7e516 (v3.4.0)
Fixed by: https://github.com/libarchive/libarchive/commit/cfaa28168a07ea4a53276b63068f94fce37d6aff (v3.6.1)
[jessie] - libarchive <not-affected> (Vulnerable code not present)