Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 4 Jun 2024 12:44:28 -0700
From: Alan Coopersmith <>
Subject: libarchive 3.7.4 released with 2 security fixes announces
the release on April 26 of libarchive 3.7.4 with 2 security fixes:

- rar: Fix OOB in rar e8 filter (#2135) (CVE-2024-26256) doesn't give details, but
   a detailed writeup from Trend Micro / ZDI has been posted at:

- zip: Fix out of boundary access (#2145) states:
   "If a ZIP file contains a file with an empty name and mac-ext option is set,
    then a check accesses memory out of bound of name."

As noted by Will Dormann on Mastodon [1], CVE-2024-26256 was issued by
Microsoft's CNA for their bundled version of libarchive, so the CVE data
currently doesn't reflect that the fix is available for other platforms
from the open source upstream.


         -Alan Coopersmith-       
          Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.