libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring (called from douncompressblock and processblock).
{ "urgency": "not yet assigned" }