CVE-2021-31566

Name	CVE-2021-31566
Description	An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2987-1, DLA-3202-1
Debian Bugs	1001990

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libarchive (PTS)	bookworm	3.6.2-1+deb12u4	fixed
	bookworm (security)	3.6.2-1+deb12u5	fixed
	trixie	3.7.4-4+deb13u1	fixed
	forky, sid	3.8.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libarchive	source	stretch	3.2.2-2+deb9u3	DLA-2987-1
libarchive	source	buster	3.3.3-4+deb10u2	DLA-3202-1
libarchive	source	bullseye	3.4.3-2+deb11u1
libarchive	source	(unstable)	3.5.2-1		1001990

Notes

https://github.com/libarchive/libarchive/issues/1566
https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043 (v3.5.2)
https://github.com/libarchive/libarchive/commit/e2ad1a2c3064fa9eba6274b3641c4c1beed25c0b (v3.5.2)