{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-4111-els_os-oraclelinux6els.json" } ], "tracking": { "current_release_date": "2026-10-25T05:00:28Z", "generator": { "date": "2026-10-25T05:00:28Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-4111-ELS_OS-ORACLELINUX6ELS", "initial_release_date": "2026-03-13T19:55:00Z", "revision_history": [ { "date": "2026-03-13T19:55:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-25T05:00:28Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2026-4111" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 6", "product": { "name": "Oracle Linux 6", "product_id": "Oracle-Linux-6", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=i686" } } }, { "category": "product_version", "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686" }, "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64" }, "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686" }, "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64" }, "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-4111", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition ('Infinite Loop')" }, "notes": [ { "category": "description", "text": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.", "title": "Vulnerability description" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-4111" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10065", "url": "https://access.redhat.com/errata/RHSA-2026:10065" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10081", "url": "https://access.redhat.com/errata/RHSA-2026:10081" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10097", "url": "https://access.redhat.com/errata/RHSA-2026:10097" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:14773", "url": "https://access.redhat.com/errata/RHSA-2026:14773" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15087", "url": "https://access.redhat.com/errata/RHSA-2026:15087" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:16008", "url": "https://access.redhat.com/errata/RHSA-2026:16008" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:16009", "url": "https://access.redhat.com/errata/RHSA-2026:16009" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:16174", "url": "https://access.redhat.com/errata/RHSA-2026:16174" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:17596", "url": "https://access.redhat.com/errata/RHSA-2026:17596" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:25096", "url": "https://access.redhat.com/errata/RHSA-2026:25096" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5063", "url": "https://access.redhat.com/errata/RHSA-2026:5063" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:5080", "url": "https://access.redhat.com/errata/RHSA-2026:5080" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6647", "url": "https://access.redhat.com/errata/RHSA-2026:6647" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7093", "url": "https://access.redhat.com/errata/RHSA-2026:7093" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7105", "url": "https://access.redhat.com/errata/RHSA-2026:7105" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7106", "url": "https://access.redhat.com/errata/RHSA-2026:7106" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7239", "url": "https://access.redhat.com/errata/RHSA-2026:7239" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7329", "url": "https://access.redhat.com/errata/RHSA-2026:7329" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7335", "url": "https://access.redhat.com/errata/RHSA-2026:7335" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:82347", "url": "https://access.redhat.com/errata/RHSA-2026:82347" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:82354", "url": "https://access.redhat.com/errata/RHSA-2026:82354" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:82372", "url": "https://access.redhat.com/errata/RHSA-2026:82372" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:82857", "url": "https://access.redhat.com/errata/RHSA-2026:82857" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8423", "url": "https://access.redhat.com/errata/RHSA-2026:8423" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8746", "url": "https://access.redhat.com/errata/RHSA-2026:8746" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8747", "url": "https://access.redhat.com/errata/RHSA-2026:8747" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8748", "url": "https://access.redhat.com/errata/RHSA-2026:8748" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8865", "url": "https://access.redhat.com/errata/RHSA-2026:8865" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8944", "url": "https://access.redhat.com/errata/RHSA-2026:8944" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:9832", "url": "https://access.redhat.com/errata/RHSA-2026:9832" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-4111", "url": "https://access.redhat.com/security/cve/CVE-2026-4111" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453" }, { "category": "external", "summary": "https://github.com/libarchive/libarchive/pull/2877", "url": "https://github.com/libarchive/libarchive/pull/2877" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4111.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4111.json" } ], "release_date": "2026-03-13T19:55:00Z", "threats": [ { "category": "impact", "details": "Important" }, { "category": "impact", "date": "2026-10-16T12:43:54.653327Z", "details": "important", "product_ids": [ "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686", "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64", "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686", "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64" ] } ] } ] }