CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

archivers/libarchive3.8.8,1

Library to create and read several streaming archive formats

Maintainer
glewis@FreeBSD.org
Packages
libarchive 3.8.8,1
Upstream
Higher version available: 3.8.10
CPE
libarchive:libarchive from the port
WWW
https://libarchive.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (4)

Show 4 fixed
VuXML entries whose affected range this version has left.

Commits (141)

Daniel Engberg (diizzy) · 3.8.8,1
archivers/libarchive: Update to 3.8.8

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.8

PR:		296310
Reviewed by:	glewis (maintainer)
1ec36ab3f0
Daniel Engberg (diizzy) · 3.8.7,1
archivers/libarchive: Update to 3.8.7

* Drop mbedtls, depends on obsolete version that's removed in tree
* Adjust iconv dependency
* Adjust port Makefile, don't pick up libb2

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.7

PR:		294607
Approved by:	maintainer timeout, 2+ weeks
20c19d22b2
Daniel Engberg (diizzy) · 3.8.5,1
archivers/libarchive: Update to 3.8.5

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.5

PR:		292226
Reviewed by:	glewis (maintainer)
4f76207b80
Daniel Engberg (diizzy) · 3.8.4,1
archivers/libarchive: Update to 3.8.4

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.4

PR:		291455
Approved by:	maintainer timeout, 3+ weeks
b01af8ad8e
Daniel Engberg (diizzy) · 3.8.3,1
archivers/libarchive: Update to 3.8.3

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.3

PR:		291087
Reviewed by:	glewis (maintainer)
81a4d35d80
Daniel Engberg (diizzy) · 3.8.2,1
archivers/libarchive: Update to 3.8.2

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.2

PR:		290308
Approved by:	maintainer timeout, 2+ weeks
d948dbf122
Baptiste Daroussin (bapt) · 3.8.1,1
archivers/*: remove unneeded USES=pathfix

The framework deals with .pc files without the needs of patching the
source (since 2017)
e3928d495a
Daniel Engberg (diizzy) · 3.8.1,1
archivers/libarchive: Update to 3.8.1

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.1

PR:		287245
Reviewed by:	glewis (maintainer)
565d0bbb89
Daniel Engberg (diizzy) · 3.8.0,1
archivers/libarchive: Update to 3.8.0

Backport upstream commit 627ba5bbbf80fe25dbf5015ef304a905a2820f17

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.8.0

Reference: https://github.com/libarchive/libarchive/commit/627ba5bbbf80fe25dbf5015ef304a905a2820f17

PR:		287073
Reviewed by:	glewis (maintainer)
c47fcd4184
Daniel Engberg (diizzy) · 3.7.9,1
archivers/libarchive: Update to 3.7.9

Previous version 3.7.8 fixed following CVEs:
CVE-2024-57970, CVE-2025-1632, CVE-2025-25724

Changelog(s):
https://github.com/libarchive/libarchive/releases/tag/v3.7.9
https://github.com/libarchive/libarchive/releases/tag/v3.7.8

PR:		285592
Reviewed by:	glewis (maintainer)
7042301865
Baptiste Daroussin (bapt) · 3.7.7_2,1
archivers/libarchive: force rebuild

prior pkg 2.0.3, libarchive was not export itself in shlibs_provide
c25ffb4eab
Tijl Coosemans (tijl) · 3.7.7_1,1
security/mbedtls: Move to security/mbedtls2

The port has expired but isn't removed yet because there are still too
many consumers.  Rename it because the name "security/mbedtls" makes it
look like it's the default version.

PR:		283792
5e762dcd49
Daniel Engberg (diizzy) · 3.7.7,1
archivers/libarchive: Update to 3.7.7

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.7.7

PR:		282067
Approved by:	portmgr (maintainer timeout, 2+ weeks)
395f483589
Daniel Engberg (diizzy) · 3.7.6,1
archivers/libarchive: Update to 3.7.6

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.7.6

PR:		281501
Reviewed by:	glewis (maintainer)
d9071da83a
Daniel Engberg (diizzy) · 3.7.4,1
archivers/libarchive: Update to 3.7.4

Backport follwing upstream commits:
b910cb70d4c1b311c9d85cd536a6c91647c43df7
83e8b0ea8c3b07e07ac3dee90a8724565f8e53fd

References:
https://github.com/libarchive/libarchive/commit/b910cb70d4c1b311c9d85cd536a6c91647c43df7
https://github.com/libarchive/libarchive/commit/83e8b0ea8c3b07e07ac3dee90a8724565f8e53fd

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.7.4
PR:		278795
Approved by:	portmgr (maintainer timeout, 2+ weeks)
d3752d08f9
Daniel Engberg (diizzy) · 3.7.2_2,1
archivers/libarchive: Backport upstream commit 6110e9c

Reference:
https://github.com/libarchive/libarchive/commit/6110e9c82d8ba830c3440f36b990483ceaaea52c

PR:		278051
Reviewed by:	glewis (maintainer)
a2151edf48
Muhammad Moinur Rahman (bofh) · 3.7.2_1,1
archivers/libarchive: Moved man to share/man

Approved by:    portmgr (blanket)
580589cae2
Muhammad Moinur Rahman (bofh) · 3.7.2,1
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree

- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
  ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
  Also move conditional flags for non sparc64/arm ARCH to fixed flags.

Reviewed by:	brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
bbab7f59e9
Daniel Engberg (diizzy) · 3.7.2,1
archivers/libarchive: Update to 3.7.2

Backport upstream commit 3bd918d92f8c34ba12de9c6604d96f9e262a59fc

Changelog:
https://github.com/libarchive/libarchive/releases/tag/v3.7.2

Reference:
https://github.com/libarchive/libarchive/commit/3bd918d92f8c34ba12de9c6604d96f9e262a59fc

PR:		274628
Reviewed by:	glewis (maintainer)
a00a9c8064
Daniel Engberg (diizzy) · 3.7.1,1
archivers/libarchive: Update to 3.7.1

* Move plist from Makefile to pkg-list

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.7.1

PR:		272577
Reviewed by:	glewis (maintainer)
Sponsored by:	Blinkinblox
bdb933b422
Daniel Engberg (diizzy) · 3.6.2,1
archivers/libarchive: Update to 3.6.2

* Backport upstream commit 1f35c466aaa9444335a1b854b0b7223b0d2346c2
  to fix iconv issue with .pc file
* Patch .pc file when compiled on versions of FreeBSD where we don't
  provide a .pc file for OpenSSL

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.6.2

PR:		268693
Reviewed by:	glewis (maintainer)
c06af01563
Daniel Engberg (diizzy) · 3.6.1_1,1
archivers/libarchive: Fix CVE 2022-36227

Backport upstream commit bff38efe8c110469c5080d387bec62a6ca15b1a5

PR:		268190
Reviewed by:	glewis (maintainer)
8841574613
Stefan Eßer (se) · 3.6.1,1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 3.6.1,1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Daniel Engberg (diizzy) · 3.6.1,1
archivers/libarchive: Update to 3.6.1

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.6.1

PR:		263189
Reviewed by:	glewis
920a27b810
Daniel Engberg (diizzy) · 3.6.0,1
archivers/libarchive: Update to 3.6.0

Backport upstream commits 52efa50c69653029687bfc545703b7340b7a51e2 and
1271f775dc917798ad7d03c3b3bd66bacad03603 for security fixes in
RAR filter, suggested by Tod Jackson

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.6.0

PR:		262069
Approved by:	glewis (maintainer timeout, 2+ weeks)
f0f7aec3e4
Tijl Coosemans (tijl) · 3.5.2_1,1
security/mbedtls: Update to 2.28.0 and fix make test

Also bump dependent ports for library version change.

PR:		255084
b93e64d3c3
Daniel Engberg (diizzy) · 3.5.2,1
archivers/libarchive: Update to 3.5.2

Use GitHub as primary MASTER_SITE and libarchive.org as fallback
Enable Zstandard compression support by default
Use xz tarball instead of gz (smaller size)
Remove entries for DESC that are already defined in ports framework
Disable static library
Do some rearrangement  of Makefile for readability

Changelog: https://github.com/libarchive/libarchive/releases/tag/v3.5.2

Approved by:	arrowd (mentor), glewis (maintainer)
Differential Revision:	https://reviews.freebsd.org/D32988
b842263427
Jimmy Olgeni (olgeni) · 3.5.1,1
*: fix tab vs. space issues, and comments according to the guide.
4460cf727a
Mathieu Arnold (mat) · 3.5.1,1
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 3.5.1,1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Greg Lewis (glewis) · 3.5.1,1
Update to 3.5.1
56f14b8253
Dima Panov (fluffy) · 3.4.3_1,1
archivers/libarchive: add mbedTLS support and remove LZO default

PR:		251496
Submitted by:	mm
Approved by:	maintainer (glewis)
575191b6a1
Greg Lewis (glewis) · 3.4.3,1
Update to 3.4.3
911e148f98
Sunpoet Po-Chuan Hsieh (sunpoet) · 3.4.2_1,1
Bump PORTREVISION for security/nettle shlib change
7f5cbfeed4
Greg Lewis (glewis) · 3.4.2,1
Update to 3.4.2

PR:		244476
Submitted by:	Yasuhiro KIMURA <yasu@utahime.org>
9839fa58ce
Greg Lewis (glewis) · 3.4.0,1
Update to 3.4.0
3c698d70a1
Sunpoet Po-Chuan Hsieh (sunpoet) · 3.3.3_1,1
Update security/nettle to 3.5.1

- Bump PORTREVISION of dependent ports for shlib change
- Fix build of devel/pijul [1]

Changes:	https://git.lysator.liu.se/nettle/nettle/blob/master/NEWS
PR:		238991
Exp-run by:	antoine
Thanks to:	tobik [1]
d99d942bb0
Greg Lewis (glewis) · 3.3.3,1
. Update to 3.3.3 . Add support for zstd compression
1dd5897b9d
Dmitry Marakasov (amdmi3) · 3.3.2_1,1
- Openssl and nettle support are not mutually exclusive, add independent options for each - Add LICENSE_FILE - Switch to USES=localbase - Switch to new test framework

PR:		231150
Approved by:	maintainer timeout (glewis, 2 weeks)
1aa242f083
Greg Lewis (glewis) · 3.3.2,1
. Fix the build with libressl-devel

PR:		226853
Submitted by:	Piotr Kubaj <pkubaj@anongoth.pl>
9fcaa71e46
Greg Lewis (glewis) · 3.3.2,1
. Update to 3.3.2 . Use https rather than http where possible. . Update WWW entry.

Reported by:	tj <tj@mrsk.me>
24fc1b741b
Martin Matuska (mm) · 3.3.1,1
Revert accidentially commited change in r440070
cee04c2058
Martin Matuska (mm) · 3.3.1_1,1
Horde package update:

comms/pear-Horde_ActiveSync 2.38.2 -> 2.38.4
devel/pear-Horde_Alarm 2.2.8 -> 2.2.9
devel/pear-Horde_Argv 2.0.12 -> 2.1.0
devel/pear-Horde_Cli 2.1.0 -> 2.2.0
archivers/pear-Horde_Compress 2.1.6 -> 2.2.0
security/pear-Horde_Crypt 2.7.6 -> 2.7.8
graphics/pear-Horde_Image 2.4.0 -> 2.4.1
www/horde-base 5.2.14 -> 5.2.15
mail/horde-imp 6.2.18 -> 6.2.19
mail/horde-ingo 3.2.14 -> 3.2.15
deskutils/horde-kronolith 4.2.20 -> 4.2.21
mail/horde-webmail 5.2.19 -> 5.2.20
deskutils/horde-groupware 5.2.19 -> 5.2.20
c3fd741fdb
Greg Lewis (glewis) · 3.3.1,1
. This reportedly now supports openssl-devel, so remove the check that   disables under those circumstances.
715893f666
Greg Lewis (glewis) · 3.3.1,1
. Fix naming.
a2fe10509c
Greg Lewis (glewis) · 3.3.1,1
. Update to 3.3.1. . Make it work with LibreSSL [1]

Submitted by:	naddy@ [1]
dc1feb606d
Mathieu Arnold (mat) · 3.2.2,1
Remove last two occurrences of USE_OPENSSL.

Reported by:	antoine
Sponsored by:	Absolight
5370921a8e
Dmitry Marakasov (amdmi3) · 3.2.2,1
Remove always-true/false conditions after 9.x, 10.[12] EOL While here, couple minor fixes

portmgr blanket
9c8a649e64
Mathieu Arnold (mat) · 3.2.2,1
Mark some ports as not openssl-devel ready.

Sponsored by:	Absolight
703ff6d361