CVE-2021-33644
libtar: out-of-bounds read in gnu_longname
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
Un atacante que envía un archivo tar diseñado con el tamaño de la estructura de cabecera siendo 0 puede ser capaz de desencadenar una llamada de malloc(0) para una variable gnu_longname, causando una lectura fuera de límites
A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with size in header struct being 0 to trigger a calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
The libtar packages contain a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions. Issues addressed include memory leak and out of bounds read vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-05-28 CVE Reserved
- 2022-08-09 CVE Published
- 2024-08-03 CVE Updated
- 2025-04-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | < 1.2.21 Search vendor "Feep" for product "Libtar" and version " < 1.2.21" | - |
Affected
| ||||||
| Huawei Search vendor "Huawei" | Openeuler Search vendor "Huawei" for product "Openeuler" | 20.03 Search vendor "Huawei" for product "Openeuler" and version "20.03" | sp1, lts |
Affected
| ||||||
| Huawei Search vendor "Huawei" | Openeuler Search vendor "Huawei" for product "Openeuler" | 20.03 Search vendor "Huawei" for product "Openeuler" and version "20.03" | sp3, lts |
Affected
| ||||||
| Huawei Search vendor "Huawei" | Openeuler Search vendor "Huawei" for product "Openeuler" | 22.03 Search vendor "Huawei" for product "Openeuler" and version "22.03" | lts |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 37 Search vendor "Fedoraproject" for product "Fedora" and version "37" | - |
Affected
| ||||||