CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2022-48303 – tar: heap buffer overflow at from_header() in list.c via specially crafted checksum
https://notcve.org/view.php?id=CVE-2022-48303
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. A flaw was found in the Tar package. When attempting to read files with old V7 tar format with a specially crafted checksum, an invalid memory read may occur. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4 https://savannah.gnu.org/bugs/?62387 https://savannah.gnu.org/patch/?10307 https://access.redhat.com/security/cve/CVE-2022-48303 https://bugzilla.redhat.com/show_bug.cgi?id=2149722 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20193
https://notcve.org/view.php?id=CVE-2021-20193
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability. Se detectó un fallo en el archivo src/list.c de tar versiones 1.33 y anteriores. Este fallo permite a un atacante que puede enviar un archivo de entrada diseñado a tar causar un consumo no controlado de memoria. • https://bugzilla.redhat.com/show_bug.cgi?id=1917565 https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777 https://savannah.gnu.org/bugs/?59897 https://security.gentoo.org/glsa/202105-29 • CWE-125: Out-of-bounds Read CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-9923
https://notcve.org/view.php?id=CVE-2019-9923
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. pax_decode_header en sparse.c en GNU Tar, en versiones anteriores a la 1.32, tenía una desreferencia de puntero NULL al analizar ciertos archivos que tenían cabeceras extendidas mal formadas. • http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120 http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html http://savannah.gnu.org/bugs/?55369 https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E • CWE-476: NULL Pointer Dereference •
CVSS: 4.7EPSS: 0%CPEs: 4EXPL: 1CVE-2018-20482
https://notcve.org/view.php?id=CVE-2018-20482
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root). GNU Tar, hasta la versión 1.30, cuando se emplea --sparse, gestiona de manera incorrecta el encogimiento de archivos durante el acceso de lectura, lo que permite que usuarios locales provoquen una denegación de servicio (bucle infinito de lectura en sparse_dump_region en sparse.c) modificando un archivo que debería ser archivado por el proceso de un usuario diferente (por ejemplo, un backup del sistema que se ejecuta como root). • http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454 http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html http://www.securityfocus.com/bid/106354 https://lists.debian.org/debian-lts-announce/2018/12/msg00023.html https://lists.debian.org/debian-lts-announce/2021/11/msg00025.html https://news.ycombinator.com/item?id=18745431 https://security.gentoo.org/glsa/201903- • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 1CVE-2016-6321 – GNU tar 1.29 Extract Pathname Bypass
https://notcve.org/view.php?id=CVE-2016-6321
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER. Vulnerabilidad de salto de directorio en la función safer_name_suffix en GNU tar 1.14 hasta la versión 1.29 podrían permitir a atacantes remotos eludir un mecanismo de protección previsto y escribir en archivos arbitarios a través de vectores relacionados con una desinfección inadecuada del parámetro file_name, también conocida como POINTYFEATHER. The GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line. Versions 1.14 through 1.29 are affected. • http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html http://seclists.org/fulldisclosure/2016/Oct/102 http://seclists.org/fulldisclosure/2016/Oct/96 http://www.debian.org/security/2016/dsa-3702 http://www.securityfocus.com/bid/93937 http://www.ubuntu.com/usn/USN-3132-1 https://lists.apache. • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •