QSN-8902-1: libarchive vulnerability
2026-10-08

Summary:
libarchive could be made to crash or run programs as your login if it
opened a specially crafted file.

Details:
It was discovered that libarchive had a signed integer overflow in its
ZIP writer when handling encrypted entries with sizes near the maximum
value. An attacker could possibly use this issue to cause libarchive to
crash or execute arbitrary code.

Affected QuantaStor releases:
  6.9.1.001 jammy: libarchive13 3.6.0-1ubuntu1.9 (fixed in 3.6.0-1ubuntu1.9)
  6.9.0.464 jammy: libarchive13 3.6.0-1ubuntu1.9 (fixed in 3.6.0-1ubuntu1.9)
  6.8.6.015 jammy: libarchive13 3.6.0-1ubuntu1.8 (fixed in 3.6.0-1ubuntu1.9)
  6.8.5.018 jammy: libarchive13 3.6.0-1ubuntu1.8 (fixed in 3.6.0-1ubuntu1.9)
  6.8.4.038 jammy: libarchive13 3.6.0-1ubuntu1.8 (fixed in 3.6.0-1ubuntu1.9)
  6.8.3.018 jammy: libarchive13 3.6.0-1ubuntu1.8 (fixed in 3.6.0-1ubuntu1.9)
  6.8.2.002 jammy: libarchive13 3.6.0-1ubuntu1.8 (fixed in 3.6.0-1ubuntu1.9)
  6.8.1.007 jammy: libarchive13 3.6.0-1ubuntu1.7 (fixed in 3.6.0-1ubuntu1.9)
  6.8.0.205 jammy: libarchive13 3.6.0-1ubuntu1.7 (fixed in 3.6.0-1ubuntu1.9)

CVEs: CVE-2026-16517

References:
  https://ubuntu.com/security/notices/USN-8902-1