Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.

A number of flaws have been corrected in upstream libarchive that have not yet been included in a public release of libarchive (latest version is 2.8.4).

A buffer overflow at reading bit lengths of huffman code of LZX when reading a broken CAB file (CVE-2010-4666) [1].

Buffer overflows in various functions related to reading archives (in archivereadsupportformatiso9660.c) (CVE-2011-1777) [2].

Buffer overflow in reading tar archives (CVE-2011-1778) [3].

Use-after-free bugs (CVE-2011-1779) [4].

[1] http://code.google.com/p/libarchive/source/detail?r=2842 [2] http://code.google.com/p/libarchive/source/detail?r=3158 [3] http://code.google.com/p/libarchive/source/detail?r=3160 [4] http://code.google.com/p/libarchive/source/detail?r=3038

archivereadsupportformattar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (crash) via (1) an end-of-file condition within a tar header that follows a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive, which results in a NULL pointer dereference, a different issue than CVE-2007-3644.

archivereadsupportformattar.c in libarchive before 2.2.4 does not properly compute the length of a certain buffer when processing a malformed pax extension header, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PAX or (2) TAR archive that triggers a buffer overflow.

archivereadsupportformattar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (infinite loop) via (1) an end-of-file condition within a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive.