Alerts This Week
Warning Icon 1 923
Alerts This Week
Warning Icon 1 923

Mageia Security Advisory MGASA-2023-0079: Critical GNU Tar Memory Flaw

mageia
Calendar Grey March 1, 2023
Dist Mageia Esm H88
Mageia issued a security patch for zip, resolving a buffer overflow vulnerability that resulted in the use of uninitialized memory.
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump

Summary

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. (CVE-2022-48303)

References

- https://bugs.mageia.org/show_bug.cgi?id=31569

- https://lists.suse.com/pipermail/sle-security-updates/2023-February/013834.html

-

- https://access.redhat.com/errata/RHSA-2023:0842

- https://www.cve.org/CVERecord?id=CVE-2022-48303

Topics%20covered

Topics Covered

security advisory critical memory issue tar out-of-bounds mageia conditional jump

Resolution

SRPMS

- 8/core/tar-1.33-2.2.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 01 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0079.html
Type: security
CVE: CVE-2022-48303

Topics%20covered

Topics Covered

security advisory critical memory issue tar out-of-bounds mageia conditional jump

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here