Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 7 articles for you...
202
security advisorymoderatesecurity issueopenSUSE Tumbleweed libtar Moderate Threat Advisory 2026-11092-1
An update that solves 3 vulnerabilities can now be installed.. # libtar-1.2.20-3.1 on GA media Announcement ID: openSUSE-SU-2026:11092-1 Rating: moderate Cross-References: * CVE-2021-33640 * CVE-2021-33643 * CVE-2021-33645 Affected Products: * openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the libtar-1.2.20-3.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libtar 1.2.20-3.1 * libtar-devel 1.2.20-3.1 * libtar1 1.2.20-3.1 ## References: * https://www.suse.com/security/cve/CVE-2021-33640.html * https://www.suse.com/security/cve/CVE-2021-33643.html * https://www.suse.com/security/cve/CVE-2021-33645.html . An update for openSUSE addresses three moderate security issues in libtar, ensuring system stability and integrity.. opensuse security advisory, libtar update, moderate vulnerabilities, cybersecurity threats, linux security updates. . Severity: moderate. LinuxSecurity.com Team
Jun 25, 2026
•moderate
OpenSUSE
219
security advisorymoderatememory leakRocky Linux 8 RLSA-2023-2898 libtar Moderate Out-of-Bounds and Memory Leak
Moderate: libtar security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2023:2898", "synopsis": "Moderate: libtar security update", "severity": "SEVERITY_MODERATE", "topic": "An update is available for libtar.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "The libtar packages contain a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions.\n\nSecurity Fix(es):\n\n* libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)\n\n* libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)\n\n* libtar: memory leak found in th_read() function (CVE-2021-33645)\n\n* libtar: memory leak found in th_read() function (CVE-2021-33646)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.", "solution": null, "affectedProducts": ["Rocky Linux 8"], "fixes": [{"ticket": "2121289", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2121289", "description": ""}, {"ticket": "2121292", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2121292", "description": ""}, {"ticket": "2121295", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2121295", "description": ""}, {"ticket": "2121297", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2121297", "description": ""}], "cves": [{"name": "CVE-2021-33643", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2021-33643", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","cvss3BaseScore": "7.4", "cwe": "CWE-125"}, {"name": "CVE-2021-33644", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2021-33644", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H", "cvss3BaseScore": "6.8", "cwe": "CWE-125"}, {"name": "CVE-2021-33645", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2021-33645", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-401"}, {"name": "CVE-2021-33646", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2021-33646", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-401"}], "references": [], "publishedAt": "2025-12-27T09:04:03.511459Z", "rpms": {"Rocky Linux 8": {"nvras": ["libtar-0:1.2.20-17.el8.aarch64.rpm", "libtar-0:1.2.20-17.el8.i686.rpm", "libtar-0:1.2.20-17.el8.src.rpm", "libtar-0:1.2.20-17.el8.x86_64.rpm", "libtar-debuginfo-0:1.2.20-17.el8.aarch64.rpm", "libtar-debuginfo-0:1.2.20-17.el8.i686.rpm", "libtar-debuginfo-0:1.2.20-17.el8.x86_64.rpm", "libtar-debugsource-0:1.2.20-17.el8.aarch64.rpm", "libtar-debugsource-0:1.2.20-17.el8.i686.rpm", "libtar-debugsource-0:1.2.20-17.el8.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. A moderate security update for libtar on Rocky Linux addresses out-of-bounds reads and memory leaks providing critical fixes.. Rocky Linux libtar Update Security Moderate Memory Leak. . Severity: moderate. LinuxSecurity.com Team
Dec 27, 2025
•moderate
Rocky Linux
172
security advisorydenial of servicesoftware updateUbuntu 7398-1: libtar Security Advisory Updates
Several security issues were fixed in libtar.. ========================================================================== Ubuntu Security Notice USN-7398-1 March 31, 2025 libtar vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in libtar. Software Description: - libtar: C library for manipulating tar archives (development files) Details: It was discovered that libtar may perform out-of-bounds reads when processing specially crafted tar files. An attacker could possibly use this issue to cause libtar to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2021-33643, CVE-2021-33644) It was discovered that libtar contained a memory leak due to failing to free a variable, causing performance degradation. An attacker could possibly use this issue to cause libtar to crash, resulting in a denial of service. (CVE-2021-33645, CVE-2021-33646) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.10 libtar-dev 1.2.20-8.1ubuntu0.24.10.1 libtar0t64 1.2.20-8.1ubuntu0.24.10.1 Ubuntu 24.04 LTS libtar-dev 1.2.20-8.1ubuntu0.24.04.1 libtar0t64 1.2.20-8.1ubuntu0.24.04.1 Ubuntu 22.04 LTS libtar-dev 1.2.20-8ubuntu0.22.04.1 libtar0 1.2.20-8ubuntu0.22.04.1 Ubuntu 20.04 LTS libtar-dev 1.2.20-8ubuntu0.20.04.1 libtar0 1.2.20-8ubuntu0.20.04.1 Ubuntu18.04 LTS libtar-dev 1.2.20-7ubuntu0.1~esm1 Available with Ubuntu Pro libtar0 1.2.20-7ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libtar-dev 1.2.20-4ubuntu0.1~esm1 Available with Ubuntu Pro libtar0 1.2.20-4ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7398-1 CVE-2021-33643, CVE-2021-33644, CVE-2021-33645, CVE-2021-33646 Package Information: https://launchpad.net/ubuntu/+source/libtar/1.2.20-8.1ubuntu0.24.10.1 https://launchpad.net/ubuntu/+source/libtar/1.2.20-8.1ubuntu0.24.04.1 https://launchpad.net/ubuntu/+source/libtar/1.2.20-8ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/libtar/1.2.20-8ubuntu0.20.04.1 . Multiple security issues in libtar can lead to denial of service and out-of-bounds read vulnerabilities. Updates available.. security, libtar, ======================================================. . Severity: Critical. LinuxSecurity.com Team
Mar 31, 2025
•Critical
Ubuntu
197
security advisorydebianmemory leakDebian LTS: DLA-4033-1 Critical Updates for libtar Memory Issues
Multiple vulnerabilities have been fixed in libtar, a library for manipulating tar archives. CVE-2021-33643 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4033-1
Jan 28, 2025
•Critical
Debian LTS
98
security advisorymoderatesecurity issueRed Hat: RHSA-2023:2898-01 Moderate: Libtar Memory Leak Issues
An update for libtar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: libtar security update Advisory ID: RHSA-2023:2898-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:2898 Issue date: 2023-05-16 CVE Names: CVE-2021-33643 CVE-2021-33644 CVE-2021-33645 CVE-2021-33646 ==================================================================== 1. Summary: An update for libtar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: The libtar packages contain a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions. Security Fix(es): * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643) * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644) * libtar: memory leak found in th_read() function (CVE-2021-33645) * libtar: memory leak found in th_read() function (CVE-2021-33646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changesin this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2121289 - CVE-2021-33643 libtar: out-of-bounds read in gnu_longlink 2121292 - CVE-2021-33644 libtar: out-of-bounds read in gnu_longname 2121295 - CVE-2021-33645 libtar: memory leak found in th_read() function 2121297 - CVE-2021-33646 libtar: memory leak found in th_read() function 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: libtar-1.2.20-17.el8.src.rpm aarch64: libtar-1.2.20-17.el8.aarch64.rpm libtar-debuginfo-1.2.20-17.el8.aarch64.rpm libtar-debugsource-1.2.20-17.el8.aarch64.rpm ppc64le: libtar-1.2.20-17.el8.ppc64le.rpm libtar-debuginfo-1.2.20-17.el8.ppc64le.rpm libtar-debugsource-1.2.20-17.el8.ppc64le.rpm s390x: libtar-1.2.20-17.el8.s390x.rpm libtar-debuginfo-1.2.20-17.el8.s390x.rpm libtar-debugsource-1.2.20-17.el8.s390x.rpm x86_64: libtar-1.2.20-17.el8.i686.rpm libtar-1.2.20-17.el8.x86_64.rpm libtar-debuginfo-1.2.20-17.el8.i686.rpm libtar-debuginfo-1.2.20-17.el8.x86_64.rpm libtar-debugsource-1.2.20-17.el8.i686.rpm libtar-debugsource-1.2.20-17.el8.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-33643 https://access.redhat.com/security/cve/CVE-2021-33644 https://access.redhat.com/security/cve/CVE-2021-33645 https://access.redhat.com/security/cve/CVE-2021-33646 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat,Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZGNwdNzjgjWX9erEAQjfPw//SoG/pVemP1peDGxUFDfBMBbldrFWpNro Te4tTe3YAkVgQgtnGZ8n3Arlrryk+3wfgQj3u9gdUj1w14YyEZC8hpWLCXI5iw/P Ul4dHHOnO0UW568dkaqUeJjl02o2ugRp2RZVt14yuZqLKmF9WCJW7lCZQLoqCIVp 7P3vZOQBlyU6BuGXO4Th86fpLDEZCboBQDA2QeNFvt+qNwvNxgb3A05217tfXnZ4 EpltZPIrl8pzEmmWA09XeFgIm5GXNiWjjR/fF3OHSgQ9cmXnafxWSBNiDlzHNQCk 0/z5gcvl+BJLceQoZBo6hdldHCiOF20jCxr8Nb/3sSJ+zAqQqqNsnDQ1TGs2GMDz Mx5JECSk0p79MMKR0mrP2NbCqxqEsqOkjinIa0PDlKNPFbEikA4l7fXu58KyHsr/ V9otYHvD1ilS7cTw1FGi198oodCofA+euZCQBNnWuFbnrCo1cyRBN6mjCMZwDgww ZhNWOUvAmkhtC5ebBb8zuMJ73ojSwiv886kJbEjDlG7SDGbMPHxEAgTHWZp5l+jw z36m+SegsAXE/UKHRYTFriRA5p1pyq/AVUMwhMXvQhwwNxPl2wsaUOJGFBw3Fu3n bAFXpxAngQvELHEFOtmL9fzbnFo93OTkvuz9tJpbvNOCmDBJJEN6Znhic0iWzT0p kHiakPvkvj4=I+bk -----END PGP SIGNATURE----- -- RHSA-announce mailing list
May 16, 2023
Red Hat
203
security advisorycriticalsoftware updateMageia 8: 2022-0488 Critical: libtar Use-After-Free Issue
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t-> th_buf) . As a result, the released memory is used (use-after-free). (CVE-2021-33640) . MGASA-2022-0488 - Updated libtar packages fix security vulnerability Publication date: 30 Dec 2022 URL: https://advisories.mageia.org/MGASA-2022-0488.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-33640 After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t-> th_buf) . As a result, the released memory is used (use-after-free). (CVE-2021-33640) References: - https://bugs.mageia.org/show_bug.cgi?id=31337 - https://lists.fedoraproject.org/archives/list/
Dec 30, 2022
•Critical
Mageia
203
security advisorymemory leakout-of-boundsMageia 8: 2022-0335 Critical: Out-Of-Bounds Access in Libtar
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643) An attacker who submits a crafted tar file with size in header struct . MGASA-2022-0335 - Updated libtar packages fix security vulnerability Publication date: 16 Sep 2022 URL: https://advisories.mageia.org/MGASA-2022-0335.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-33643, CVE-2021-33644, CVE-2021-33645, CVE-2021-33646 An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643) An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644) The th_read() function doesn't free a variable t-> th_buf.gnu_longlink after allocating memory, which may cause a memory leak. (CVE-2021-33645) The th_read() function doesn't free a variable t-> th_buf.gnu_longname after allocating memory, which may cause a memory leak. (CVE-2021-33646) References: - https://bugs.mageia.org/show_bug.cgi?id=30821 - https://lists.fedoraproject.org/archives/list/
Sep 16, 2022
•Critical
Mageia
89
security advisoryhigh severitysoftware updateFedora 37: FEDORA-2022-44a20bba43 High: Libtar Memory Leak Fix
- fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-44a20bba43 2022-09-12 17:36:48.817631 --------------------------------------------------------------------------------Name : libtar Product : Fedora 37 Version : 1.2.20 Release : 25.fc37 URL : https://repo.or.cz/libtar.git Summary : Tar file manipulation API Description : libtar is a C library for manipulating tar archives. It supports both the strict POSIX tar format and many of the commonly-used GNU extensions. --------------------------------------------------------------------------------Update Information: - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) -fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) --------------------------------------------------------------------------------ChangeLog: * Fri Aug 26 2022 Kamil Dudka - 1.2.20-25 - fix memory leaks through gnu_long{name,link} (CVE-2021-33645 CVE-2021-33646) - fix out-of-bounds read in gnu_long{name,link} (CVE-2021-33643 CVE-2021-33644) --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-44a20bba43' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Sep 12, 2022
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!