Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
91
security advisoryhigh severitysecurity issueGentoo: GLSA-202402-12 High: GNU Tar Out Of Bounds Read Threat
A vulnerability has been discovered in GNU Tar which may lead to an out of bounds read.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202402-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: GNU Tar: Out of Bounds Read Date: February 18, 2024 Bugs: #898176 ID: 202402-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A vulnerability has been discovered in GNU Tar which may lead to an out of bounds read. Background ========== The GNU Tar program provides the ability to create tar archives, as well as various other kinds of manipulation. Affected packages ================= Package Vulnerable Unaffected ------------ ------------ ------------ app-arch/tar < 1.34-r3 > = 1.34-r3 Description =========== A vulnerability have been discovered in GNU Tar. Please review the CVE identifier referenced below for details. Impact ====== GNU Tar has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs via a V7 archive in which mtime has approximately 11 whitespace characters. Workaround ========== There is no known workaround at this time. Resolution ========== All GNU Tar users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-arch/tar-1.34-r3" References ========== [ 1 ] CVE-2022-48303 https://nvd.nist.gov/vuln/detail/CVE-2022-48303 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202402-12 Concerns? ========= Security is a primary focus of Gentoo Linux andensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Feb 18, 2024
Gentoo
91
security advisorysecurity issuegentooGentoo: GLSA-202110-02 Normal: GNU Tar Archive Extraction Vulnerability
A directory traversal vulnerability has been discovered in GNU Tar.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200709-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GNU Tar: Directory traversal vulnerability Date: September 15, 2007 Bugs: #189682 ID: 200709-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A directory traversal vulnerability has been discovered in GNU Tar. Background ========= The GNU Tar program provides the ability to create tar archives, as well as various other kinds of manipulation. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-arch/tar < 1.18-r2 > = 1.18-r2 Description ========== Dmitry V. Levin discovered a directory traversal vulnerability in the contains_dot_dot() function in file src/names.c. Impact ===== By enticing a user to extract a specially crafted tar archive, a remote attacker could extract files to arbitrary locations outside of the specified directory with the permissions of the user running GNU Tar. Workaround ========= There is no known workaround at this time. Resolution ========= All GNU Tar users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-arch/tar-1.18-r2" References ========= [ 1 ] CVE-2007-4131 https://www.cve.org/CVERecord?id=CVE-2007-4131 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200709-09 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 16, 2007
Gentoo
91
security advisorygentoobuffer overflowGentoo GLSA-200603-06 Normal Risk: GNU Tar Code Execution
A malicious tar archive could trigger a Buffer overflow in GNU tar, potentially resulting in the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200603-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GNU tar: Buffer overflow Date: March 10, 2006 Bugs: #123038 ID: 200603-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A malicious tar archive could trigger a Buffer overflow in GNU tar, potentially resulting in the execution of arbitrary code. Background ========= GNU tar is the standard GNU utility for creating and manipulating tar archives, a common format used for creating backups and distributing files on UNIX-like systems. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-arch/tar < 1.15.1-r1 > = 1.15.1-r1 Description ========== Jim Meyering discovered a flaw in the handling of certain header fields that could result in a buffer overflow when extracting or listing the contents of an archive. Impact ===== A remote attacker could construct a malicious tar archive that could potentially execute arbitrary code with the privileges of the user running GNU tar. Workaround ========= There is no known workaround at this time. Resolution ========= All GNU tar users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-arch/tar-1.15.1-r1" References ========= [ 1 ] CVE-2006-0300 Availability =========== This GLSA and any updates to it areavailable for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200603-06 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Mar 10, 2006
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!