A number of flaws have been corrected in upstream libarchive that have not yet been included in a public release of libarchive (latest version is 2.8.4).

A buffer overflow at reading bit lengths of huffman code of LZX when reading a broken CAB file (CVE-2010-4666) [1].

Buffer overflows in various functions related to reading archives (in archivereadsupportformatiso9660.c) (CVE-2011-1777) [2].

Buffer overflow in reading tar archives (CVE-2011-1778) [3].

Use-after-free bugs (CVE-2011-1779) [4].

[1] http://code.google.com/p/libarchive/source/detail?r=2842 [2] http://code.google.com/p/libarchive/source/detail?r=3158 [3] http://code.google.com/p/libarchive/source/detail?r=3160 [4] http://code.google.com/p/libarchive/source/detail?r=3038