executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.
{ "binaries": [ { "binary_version": "3.6.0-1ubuntu1.2", "binary_name": "libarchive-dev" }, { "binary_version": "3.6.0-1ubuntu1.2", "binary_name": "libarchive-tools" }, { "binary_version": "3.6.0-1ubuntu1.2", "binary_name": "libarchive13" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_version": "3.7.2-2ubuntu0.2", "binary_name": "libarchive-dev" }, { "binary_version": "3.7.2-2ubuntu0.2", "binary_name": "libarchive-tools" }, { "binary_version": "3.7.2-2ubuntu0.2", "binary_name": "libarchive13t64" } ], "availability": "No subscription required" }