[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5aca9685-c0ee-4209-b9a5-5e9ab17d7a37@oracle.com>
Date: Thu, 10 Oct 2024 12:52:52 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: libarchive 3.7.5 released with security fixes
https://github.com/libarchive/libarchive/releases/tag/v3.7.5 announces
the release on Sept. 13 of libarchive 3.7.5 with these identified security
fixes:
- fix multiple vulnerabilities identified by SAST (#2251, #2256)
- cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing (#2258)
- lzop: prevent integer overflow (#2174)
- rar4: protect copy_from_lzss_window_to_unp() (#2172, CVE-2024-20696)
- rar4: fix CVE-2024-26256 (#2269, CVS-2024-26256)
- rar4: fix OOB in delta and audio filter (#2148, #2149)
- rar4: fix out of boundary access with large files (#2179)
- rar4: add boundary checks to rgb filter (#2210)
- rar4: fix OOB access with unicode filenames (#2203)
- rar5: clear 'data ready' cache on window buffer reallocs (#2265)
- rpm: calculate huge header sizes correctly (#2158)
- unzip: unify EOF handling (#2175)
- util: fix out of boundary access in mktemp functions (#2160)
- uu: stop processing if lines are too long (#2168)
It appears Mitre has issued CVE-2024-48957 (#2149) & CVE-2024-48958 (#2148)
for the issues listed above as:
- rar4: fix OOB in delta and audio filter (#2148, #2149)
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
