https://github.com/libarchive/libarchive/releases/tag/v3.7.4 announces the release on April 26 of libarchive 3.7.4 with 2 security fixes:
- rar: Fix OOB in rar e8 filter (#2135) (CVE-2024-26256) https://github.com/libarchive/libarchive/pull/2135 doesn't give details, but a detailed writeup from Trend Micro / ZDI has been posted at: https://www.zerodayinitiative.com/blog/2024/4/17/cve-2024-20697-windows-libarchive-remote-code-execution-vulnerability - zip: Fix out of boundary access (#2145) https://github.com/libarchive/libarchive/pull/2145 states: "If a ZIP file contains a file with an empty name and mac-ext option is set, then a check accesses memory out of bound of name." As noted by Will Dormann on Mastodon [1], CVE-2024-26256 was issued by Microsoft's CNA for their bundled version of libarchive, so the CVE data currently doesn't reflect that the fix is available for other platforms from the open source upstream. [1] https://infosec.exchange/@wdormann/112559605548386109 -- -Alan Coopersmith- alan.coopersm...@oracle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
