Debian 4.0: DSA-1455-1 Critical: Libarchive1 Buffer Overflow

CVE-2007-3641

It was discovered that libarchive1 would miscompute the length of a buffer
resulting in a buffer overflow if yet another type of corruption occurred
in a pax extension header.

CVE-2007-3644

It was discovered that if an archive prematurely ended within a pax
extension header the libarchive1 library could enter an infinite loop.

CVE-2007-3645

If an archive prematurely ended within a tar header, immediately following
a pax extension header, libarchive1 could dereference a NULL pointer.


The old stable distribution (sarge), does not contain this package.

For the stable distribution (etch), these problems have been fixed in
version 1.2.53-2etch1.

For the unstable distribution (sid), these problems have been fixed in
version 2.2.4-1.

We recommend that you upgrade your libarchive package.


Upgrade instructions
- --------------------wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using...