Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 5 articles for you...
172
security advisorydenial of servicesoftware updateUbuntu 7398-1: libtar Security Advisory Updates
Several security issues were fixed in libtar.. ========================================================================== Ubuntu Security Notice USN-7398-1 March 31, 2025 libtar vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in libtar. Software Description: - libtar: C library for manipulating tar archives (development files) Details: It was discovered that libtar may perform out-of-bounds reads when processing specially crafted tar files. An attacker could possibly use this issue to cause libtar to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2021-33643, CVE-2021-33644) It was discovered that libtar contained a memory leak due to failing to free a variable, causing performance degradation. An attacker could possibly use this issue to cause libtar to crash, resulting in a denial of service. (CVE-2021-33645, CVE-2021-33646) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 libtar-dev 1.2.20-8.1ubuntu0.24.10.1 libtar0t64 1.2.20-8.1ubuntu0.24.10.1 Ubuntu 24.04 LTS libtar-dev 1.2.20-8.1ubuntu0.24.04.1 libtar0t64 1.2.20-8.1ubuntu0.24.04.1 Ubuntu 22.04 LTS libtar-dev 1.2.20-8ubuntu0.22.04.1 libtar0 1.2.20-8ubuntu0.22.04.1 Ubuntu 20.04 LTS libtar-dev 1.2.20-8ubuntu0.20.04.1 libtar0 1.2.20-8ubuntu0.20.04.1 Ubuntu18.04 LTS libtar-dev 1.2.20-7ubuntu0.1~esm1 Available with Ubuntu Pro libtar0 1.2.20-7ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libtar-dev 1.2.20-4ubuntu0.1~esm1 Available with Ubuntu Pro libtar0 1.2.20-4ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7398-1 CVE-2021-33643, CVE-2021-33644, CVE-2021-33645, CVE-2021-33646 Package Information: https://launchpad.net/ubuntu/+source/libtar/1.2.20-8.1ubuntu0.24.10.1 https://launchpad.net/ubuntu/+source/libtar/1.2.20-8.1ubuntu0.24.04.1 https://launchpad.net/ubuntu/+source/libtar/1.2.20-8ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/libtar/1.2.20-8ubuntu0.20.04.1 . Multiple security issues in libtar can lead to denial of service and out-of-bounds read vulnerabilities. Updates available.. security, libtar, ======================================================. . Severity: Critical. LinuxSecurity.com Team
Mar 31, 2025
•Critical
Ubuntu
197
security advisorydebianmemory leakDebian LTS: DLA-4033-1 Critical Updates for libtar Memory Issues
Multiple vulnerabilities have been fixed in libtar, a library for manipulating tar archives. CVE-2021-33643 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4033-1
Jan 28, 2025
•Critical
Debian LTS
98
security advisorymoderatesecurity issueRed Hat: RHSA-2023:2898-01 Moderate: Libtar Memory Leak Issues
An update for libtar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: libtar security update Advisory ID: RHSA-2023:2898-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:2898 Issue date: 2023-05-16 CVE Names: CVE-2021-33643 CVE-2021-33644 CVE-2021-33645 CVE-2021-33646 ==================================================================== 1. Summary: An update for libtar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The libtar packages contain a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions. Security Fix(es): * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643) * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644) * libtar: memory leak found in th_read() function (CVE-2021-33645) * libtar: memory leak found in th_read() function (CVE-2021-33646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changesin this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2121289 - CVE-2021-33643 libtar: out-of-bounds read in gnu_longlink 2121292 - CVE-2021-33644 libtar: out-of-bounds read in gnu_longname 2121295 - CVE-2021-33645 libtar: memory leak found in th_read() function 2121297 - CVE-2021-33646 libtar: memory leak found in th_read() function 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: libtar-1.2.20-17.el8.src.rpm aarch64: libtar-1.2.20-17.el8.aarch64.rpm libtar-debuginfo-1.2.20-17.el8.aarch64.rpm libtar-debugsource-1.2.20-17.el8.aarch64.rpm ppc64le: libtar-1.2.20-17.el8.ppc64le.rpm libtar-debuginfo-1.2.20-17.el8.ppc64le.rpm libtar-debugsource-1.2.20-17.el8.ppc64le.rpm s390x: libtar-1.2.20-17.el8.s390x.rpm libtar-debuginfo-1.2.20-17.el8.s390x.rpm libtar-debugsource-1.2.20-17.el8.s390x.rpm x86_64: libtar-1.2.20-17.el8.i686.rpm libtar-1.2.20-17.el8.x86_64.rpm libtar-debuginfo-1.2.20-17.el8.i686.rpm libtar-debuginfo-1.2.20-17.el8.x86_64.rpm libtar-debugsource-1.2.20-17.el8.i686.rpm libtar-debugsource-1.2.20-17.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-33643 https://access.redhat.com/security/cve/CVE-2021-33644 https://access.redhat.com/security/cve/CVE-2021-33645 https://access.redhat.com/security/cve/CVE-2021-33646 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat,Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZGNwdNzjgjWX9erEAQjfPw//SoG/pVemP1peDGxUFDfBMBbldrFWpNro Te4tTe3YAkVgQgtnGZ8n3Arlrryk+3wfgQj3u9gdUj1w14YyEZC8hpWLCXI5iw/P Ul4dHHOnO0UW568dkaqUeJjl02o2ugRp2RZVt14yuZqLKmF9WCJW7lCZQLoqCIVp 7P3vZOQBlyU6BuGXO4Th86fpLDEZCboBQDA2QeNFvt+qNwvNxgb3A05217tfXnZ4 EpltZPIrl8pzEmmWA09XeFgIm5GXNiWjjR/fF3OHSgQ9cmXnafxWSBNiDlzHNQCk 0/z5gcvl+BJLceQoZBo6hdldHCiOF20jCxr8Nb/3sSJ+zAqQqqNsnDQ1TGs2GMDz Mx5JECSk0p79MMKR0mrP2NbCqxqEsqOkjinIa0PDlKNPFbEikA4l7fXu58KyHsr/ V9otYHvD1ilS7cTw1FGi198oodCofA+euZCQBNnWuFbnrCo1cyRBN6mjCMZwDgww ZhNWOUvAmkhtC5ebBb8zuMJ73ojSwiv886kJbEjDlG7SDGbMPHxEAgTHWZp5l+jw z36m+SegsAXE/UKHRYTFriRA5p1pyq/AVUMwhMXvQhwwNxPl2wsaUOJGFBw3Fu3n bAFXpxAngQvELHEFOtmL9fzbnFo93OTkvuz9tJpbvNOCmDBJJEN6Znhic0iWzT0p kHiakPvkvj4=I+bk -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 16, 2023
Red Hat
203
security advisorycriticalsoftware updateMageia 8: 2022-0488 Critical: libtar Use-After-Free Issue
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t-> th_buf) . As a result, the released memory is used (use-after-free). (CVE-2021-33640) . MGASA-2022-0488 - Updated libtar packages fix security vulnerability Publication date: 30 Dec 2022 URL: https://advisories.mageia.org/MGASA-2022-0488.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-33640 After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t-> th_buf) . As a result, the released memory is used (use-after-free). (CVE-2021-33640) References: - https://bugs.mageia.org/show_bug.cgi?id=31337 - https://lists.fedoraproject.org/archives/list/
Dec 30, 2022
•Critical
Mageia
203
security advisorymemory leakout-of-boundsMageia 8: 2022-0335 Critical: Out-Of-Bounds Access in Libtar
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643) An attacker who submits a crafted tar file with size in header struct . MGASA-2022-0335 - Updated libtar packages fix security vulnerability Publication date: 16 Sep 2022 URL: https://advisories.mageia.org/MGASA-2022-0335.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-33643, CVE-2021-33644, CVE-2021-33645, CVE-2021-33646 An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643) An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644) The th_read() function doesn't free a variable t-> th_buf.gnu_longlink after allocating memory, which may cause a memory leak. (CVE-2021-33645) The th_read() function doesn't free a variable t-> th_buf.gnu_longname after allocating memory, which may cause a memory leak. (CVE-2021-33646) References: - https://bugs.mageia.org/show_bug.cgi?id=30821 - https://lists.fedoraproject.org/archives/list/
Sep 16, 2022
•Critical
Mageia
89
security advisoryhigh severitysoftware updateFedora 37: FEDORA-2022-44a20bba43 High: Libtar Memory Leak Fix
- fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-44a20bba43 2022-09-12 17:36:48.817631 --------------------------------------------------------------------------------Name : libtar Product : Fedora 37 Version : 1.2.20 Release : 25.fc37 URL : https://repo.or.cz/libtar.git Summary : Tar file manipulation API Description : libtar is a C library for manipulating tar archives. It supports both the strict POSIX tar format and many of the commonly-used GNU extensions. --------------------------------------------------------------------------------Update Information: - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) -fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) --------------------------------------------------------------------------------ChangeLog: * Fri Aug 26 2022 Kamil Dudka - 1.2.20-25 - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-44a20bba43' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 12, 2022
Fedora
89
security advisorycriticalsoftware updateFedora 35: FEDORA-2022-fe1a4e3cf0 Critical Memory Leaks and Fixes
- fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-fe1a4e3cf0 2022-09-04 22:56:03.503986 --------------------------------------------------------------------------------Name : libtar Product : Fedora 35 Version : 1.2.20 Release : 25.fc35 URL : https://repo.or.cz/libtar.git Summary : Tar file manipulation API Description : libtar is a C library for manipulating tar archives. It supports both the strict POSIX tar format and many of the commonly-used GNU extensions. --------------------------------------------------------------------------------Update Information: - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) -fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) --------------------------------------------------------------------------------ChangeLog: * Fri Aug 26 2022 Kamil Dudka - 1.2.20-25 - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) * Thu Jul 21 2022 Fedora Release Engineering - 1.2.20-24 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Thu Jan 20 2022 Fedora Release Engineering - 1.2.20-23 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-fe1a4e3cf0' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 04, 2022
•Critical
Fedora
89
security advisorycriticalsoftware updateFedora: 2022-50e8a1b51d Critical: Fix Memory Leaks In Libtar API
- fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-50e8a1b51d 2022-09-04 22:43:39.751430 --------------------------------------------------------------------------------Name : libtar Product : Fedora 36 Version : 1.2.20 Release : 25.fc36 URL : https://repo.or.cz/libtar.git Summary : Tar file manipulation API Description : libtar is a C library for manipulating tar archives. It supports both the strict POSIX tar format and many of the commonly-used GNU extensions. --------------------------------------------------------------------------------Update Information: - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) -fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) --------------------------------------------------------------------------------ChangeLog: * Fri Aug 26 2022 Kamil Dudka - 1.2.20-25 - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) * Thu Jul 21 2022 Fedora Release Engineering - 1.2.20-24 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-50e8a1b51d' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 04, 2022
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!