Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <d06cc1fc-aac0-4f33-8c6a-8b8e09b330e2@oracle.com>
Date: Tue, 4 Jun 2024 12:44:28 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: libarchive 3.7.4 released with 2 security fixes

https://github.com/libarchive/libarchive/releases/tag/v3.7.4 announces
the release on April 26 of libarchive 3.7.4 with 2 security fixes:

- rar: Fix OOB in rar e8 filter (#2135) (CVE-2024-26256)
   https://github.com/libarchive/libarchive/pull/2135 doesn't give details, but
   a detailed writeup from Trend Micro / ZDI has been posted at:
   https://www.zerodayinitiative.com/blog/2024/4/17/cve-2024-20697-windows-libarchive-remote-code-execution-vulnerability

- zip: Fix out of boundary access (#2145)
   https://github.com/libarchive/libarchive/pull/2145 states:
   "If a ZIP file contains a file with an empty name and mac-ext option is set,
    then a check accesses memory out of bound of name."

As noted by Will Dormann on Mastodon [1], CVE-2024-26256 was issued by
Microsoft's CNA for their bundled version of libarchive, so the CVE data
currently doesn't reflect that the fix is available for other platforms
from the open source upstream.

[1] https://infosec.exchange/@wdormann/112559605548386109

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.