libarchive 3.7.4 released with 2 security fixes

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://github.com/libarchive/libarchive/releases/tag/v3.7.4 announces
the release on April 26 of libarchive 3.7.4 with 2 security fixes:

- rar: Fix OOB in rar e8 filter (#2135) (CVE-2024-26256)
  https://github.com/libarchive/libarchive/pull/2135 doesn't give details, but
  a detailed writeup from Trend Micro / ZDI has been posted at:
  https://www.zerodayinitiative.com/blog/2024/4/17/cve-2024-20697-windows-libarchive-remote-code-execution-vulnerability

- zip: Fix out of boundary access (#2145)
  https://github.com/libarchive/libarchive/pull/2145 states:
  "If a ZIP file contains a file with an empty name and mac-ext option is set,
   then a check accesses memory out of bound of name."

As noted by Will Dormann on Mastodon [1], CVE-2024-26256 was issued by
Microsoft's CNA for their bundled version of libarchive, so the CVE data
currently doesn't reflect that the fix is available for other platforms
from the open source upstream.

[1] https://infosec.exchange/@wdormann/112559605548386109

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris