Bug#874065: unrar-free: Should unrar-free be removed from the archive? Alternatives (libarchive) exist; unmaintained upstream; has security issues

[Bastian Germann]

On Mon, 16 Oct 2017 01:19:18 +0800 "Ying-Chun Liu (PaulLiu)" 
<paul...@debian.org> wrote:

severity 874065 important
Hi all,

I've fixed the security issues happened on unrar-free. Seems not hard.
But as I explain before that I think programs should move to use unar if
possible.

But to me I think there's still many programs which depends on the
command line unrar-nonfree tool thus unrar-free still is needed for
compatibility. I'm lowering the severity of this bug temporarily and
will look on how many other programs are still depends on unrar-nonfree.

Yours Sincerely,
Paul

Hi,

I have ported unrar-free to libarchive at 
https://gitlab.com/bgermann/unrar-free.
You can import that as a new upstream.

Thanks,
Bastian