In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference or, in some cases, even arbitrary code execution.
Created cmake3 tracking bugs for this issue:
Affects: epel-all [bug 2144973]
Created libarchive tracking bugs for this issue:
Affects: fedora-all [bug 2144974]
Created mingw-libarchive tracking bugs for this issue:
Affects: fedora-all [bug 2144975]