SUSE-SU-2026:21757-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202621757-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21757-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:21757-1
- Upstream
CVE (4)
- CVE-2026-4111
- CVE-2026-4424
- CVE-2026-4426
- CVE-2026-5121
- Related
- Published
- 2026-05-25T07:42:39Z
- Modified
- 2026-05-27T18:24:07Z
- Summary
- Security update for libarchive
- Details
-
This update for libarchive fixes the following issues
- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
- CVE-2026-4424: 257-byte heap memory leak when processing a 170-byte RAR3 (bsc#1259928).
- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
- CVE-2026-5121: missing validation check for pz_log2_bs can a heap buffer overflow write (bsc#1261186).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202621757-1/
- https://bugzilla.suse.com/1259635
- https://bugzilla.suse.com/1259928
- https://bugzilla.suse.com/1259931
- https://bugzilla.suse.com/1261186
- https://www.suse.com/security/cve/CVE-2026-4111
- https://www.suse.com/security/cve/CVE-2026-4424
- https://www.suse.com/security/cve/CVE-2026-4426
- https://www.suse.com/security/cve/CVE-2026-5121