[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <d06cc1fc-aac0-4f33-8c6a-8b8e09b330e2@oracle.com>
Date: Tue, 4 Jun 2024 12:44:28 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: libarchive 3.7.4 released with 2 security fixes
https://github.com/libarchive/libarchive/releases/tag/v3.7.4 announces
the release on April 26 of libarchive 3.7.4 with 2 security fixes:
- rar: Fix OOB in rar e8 filter (#2135) (CVE-2024-26256)
https://github.com/libarchive/libarchive/pull/2135 doesn't give details, but
a detailed writeup from Trend Micro / ZDI has been posted at:
https://www.zerodayinitiative.com/blog/2024/4/17/cve-2024-20697-windows-libarchive-remote-code-execution-vulnerability
- zip: Fix out of boundary access (#2145)
https://github.com/libarchive/libarchive/pull/2145 states:
"If a ZIP file contains a file with an empty name and mac-ext option is set,
then a check accesses memory out of bound of name."
As noted by Will Dormann on Mastodon [1], CVE-2024-26256 was issued by
Microsoft's CNA for their bundled version of libarchive, so the CVE data
currently doesn't reflect that the fix is available for other platforms
from the open source upstream.
[1] https://infosec.exchange/@wdormann/112559605548386109
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
