Processing fixup entries may follow symbolic links. (CVE-2021-31566)
libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring (called from douncompressblock and processblock). (CVE-2021-36976)