Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 66 articles for you...
172
security advisoryUbuntuimportantUbuntu 26.04 Tar Important Regression Extraction Issue USN-8477-2
USN-8477-1 introduced a regression in tar. ========================================================================== Ubuntu Security Notice USN-8477-2 July 16, 2026 tar regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: USN-8477-1 introduced a regression in tar Software Description: - tar: GNU tar archive utility Details: USN-8477-1 fixed a vulnerability in tar. The update introduced a regression that could cause tar to fail to extract certain valid files. This update fixes the problem. Original advisory details: It was discovered that tar incorrectly handled certain crafted archive files. An attacker could possibly use this to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS tar 1.35+dfsg-4ubuntu0.3 Ubuntu 24.04 LTS tar 1.35+dfsg-3ubuntu0.3 Ubuntu 22.04 LTS tar 1.34+dfsg-1ubuntu0.1.22.04.5 Ubuntu 20.04 LTS tar 1.30+dfsg-7ubuntu0.20.04.4+esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS tar 1.29b-2ubuntu0.4+esm3 Available with Ubuntu Pro Ubuntu 16.04 LTS tar 1.28-2.1ubuntu0.2+esm5 Available with Ubuntu Pro Ubuntu 14.04 LTS tar 1.27.1-1ubuntu0.1+esm6 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8477-2 https://ubuntu.com/security/notices/USN-8477-1 CVE-2026-5704, https://launchpad.net/bugs/2160650 Package Information: https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-4ubuntu0.3 https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-3ubuntu0.3 https://launchpad.net/ubuntu/+source/tar/1.34+dfsg-1ubuntu0.1.22.04.5 . A regression in the tar package has been fixed in Ubuntu to ensure proper file extraction and security integrity.. Ubuntu Security, tar Update, Software Vulnerability, System Security, File Extraction Issue. . Severity: Important. LinuxSecurity.com Team
Jul 16, 2026
•Important
Ubuntu
172
security advisoryfile overwriteUbuntuUbuntu 26.04 Tar Important File Overwrite Issue USN-8510-1 CVE-2025-45582
tar could be made to overwrite files.. ========================================================================== Ubuntu Security Notice USN-8510-1 July 06, 2026 tar vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: tar could be made to overwrite files. Software Description: - tar: GNU tar archive utility Details: It was discovered that tar incorrectly handled symlinks when extracting archives. An attacker could possibly use this issue to overwrite arbitrary files. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS tar 1.35+dfsg-4ubuntu0.2 Ubuntu 24.04 LTS tar 1.35+dfsg-3ubuntu0.2 Ubuntu 22.04 LTS tar 1.34+dfsg-1ubuntu0.1.22.04.4 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8510-1 CVE-2025-45582 Package Information: https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-4ubuntu0.2 https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-3ubuntu0.2 https://launchpad.net/ubuntu/+source/tar/1.34+dfsg-1ubuntu0.1.22.04.4 . Critical update for Ubuntu regarding tar file overwrite issue. Details on severity and system patches included.. Ubuntu Security Update, tar Package, File Overwrite Risk. . Severity: Important. LinuxSecurity.com Team
Jul 06, 2026
•Important
Ubuntu
100
security advisorySuSEpatchSUSE 16.0 Tar Important File Injection Issues Fix 2026-22377-1
An update that solves two vulnerabilities and has one fix can now be installed.. # Security update for tar Announcement ID: SUSE-SU-2026:22377-1 Release Date: 2026-06-26T09:13:30Z Rating: important References: * bsc#1261900 * bsc#1265450 * bsc#1267189 Cross-References: * CVE-2025-45582 * CVE-2026-5704 CVSS scores: * CVE-2025-45582 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-45582 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-45582 ( NVD ): 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L * CVE-2026-5704 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-5704 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( NVD ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves two vulnerabilities and has one fix can now be installed. ## Description: This update for tar fixes the following issues * CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900). * Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-1092=1 * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-1092=1 ## Package List: * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64) * tar-debugsource-1.35-160000.4.1 * tar-rmt-debuginfo-1.35-160000.4.1 * tar-debuginfo-1.35-160000.4.1 * tar-1.35-160000.4.1 *tar-rmt-1.35-160000.4.1 * SUSE Linux Enterprise Server 16.0 (noarch) * tar-backup-scripts-1.35-160000.4.1 * tar-lang-1.35-160000.4.1 * tar-doc-1.35-160000.4.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch) * tar-backup-scripts-1.35-160000.4.1 * tar-lang-1.35-160000.4.1 * tar-doc-1.35-160000.4.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64) * tar-debugsource-1.35-160000.4.1 * tar-rmt-debuginfo-1.35-160000.4.1 * tar-debuginfo-1.35-160000.4.1 * tar-1.35-160000.4.1 * tar-rmt-1.35-160000.4.1 ## References: * https://www.suse.com/security/cve/CVE-2025-45582.html * https://www.suse.com/security/cve/CVE-2026-5704.html * https://bugzilla.suse.com/show_bug.cgi?id=1261900 * https://bugzilla.suse.com/show_bug.cgi?id=1265450 * https://bugzilla.suse.com/show_bug.cgi?id=1267189 . SUSE updates the tar package fixing critical injection issues and improving security on Enterprise Server 16.0.. SUSE Linux update, tar security patch, important vulnerabilities, SUSE advisory, Linux application security. . Severity: Important. LinuxSecurity.com Team
Jul 01, 2026
•Important
SuSE
100
security advisorySuSEsecurity fixSUSE Tar Critical File Injection Security Vulnerability 2026-2714-1
An update that solves one vulnerability and has two security fixes can now be installed.. # Security update for tar Announcement ID: SUSE-SU-2026:2714-1 Release Date: 2026-06-30T12:05:34Z Rating: important References: * bsc#1261900 * bsc#1265450 * bsc#1267189 Cross-References: * CVE-2026-5704 CVSS scores: * CVE-2026-5704 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-5704 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( NVD ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: * Basesystem Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves one vulnerability and has two security fixes can now be installed. ##Description: This update for tar fixes the following issues Security fixes: * CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900). Other fixes: * Fix tar changing dir permissions temporarily even when using --no-overwrite- dir. * Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450). * Fix extraction failure for paths like "a/./b" caused by the gnulib openat2 implementation (bsc#1267189). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-2714=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2026-2714=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-2714=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-2714=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-2714=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2026-2714=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-2714=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-2714=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2714=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-2714=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-2714=1 * SUSE Linux Enterprise Server for SAP Applications15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2714=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-2714=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-2714=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2026-2714=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-2714=1 ## Package List: * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux EnterpriseServer for SAP Applications 15 SP5 (ppc64le x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64ppc64le s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * tar-lang-1.34-150000.3.42.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * Basesystem Module 15-SP7 (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * tar-lang-1.34-150000.3.42.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * tar-debuginfo-1.34-150000.3.42.1 * tar-1.34-150000.3.42.1 * tar-rmt-1.34-150000.3.42.1 * tar-rmt-debuginfo-1.34-150000.3.42.1 * tar-debugsource-1.34-150000.3.42.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * tar-lang-1.34-150000.3.42.1 ## References: * https://www.suse.com/security/cve/CVE-2026-5704.html * https://bugzilla.suse.com/show_bug.cgi?id=1261900 * https://bugzilla.suse.com/show_bug.cgi?id=1265450 * https://bugzilla.suse.com/show_bug.cgi?id=1267189 . SUSE issues important update for tar addressing critical security concerns. Ensure timely installation for security enhancements.. SUSE security update, tar security, Linux tar fix, SUSE vulnerability patch, important CVE fix. . Severity: Important. LinuxSecurity.com Team
Jun 30, 2026
•Important
SuSE
172
security advisorycriticalUbuntuUbuntu 26.04 Tar Critical File Overwrite Threat USN-8477-1 CVE-2026-5704
tar could be made to overwrite files if it opened a specially crafted archive.. ========================================================================== Ubuntu Security Notice USN-8477-1 June 25, 2026 tar vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: tar could be made to overwrite files if it opened a specially crafted archive. Software Description: - tar: GNU tar archive utility Details: It was discovered that tar incorrectly handled certain crafted archive files. An attacker could possibly use this to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS tar 1.35+dfsg-4ubuntu0.1 Ubuntu 24.04 LTS tar 1.35+dfsg-3ubuntu0.1 Ubuntu 22.04 LTS tar 1.34+dfsg-1ubuntu0.1.22.04.3 Ubuntu 20.04 LTS tar 1.30+dfsg-7ubuntu0.20.04.4+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS tar 1.29b-2ubuntu0.4+esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS tar 1.28-2.1ubuntu0.2+esm4 Available with Ubuntu Pro Ubuntu 14.04 LTS tar 1.27.1-1ubuntu0.1+esm5 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8477-1 CVE-2026-5704 Package Information: https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-4ubuntu0.1 https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-3ubuntu0.1 https://launchpad.net/ubuntu/+source/tar/1.34+dfsg-1ubuntu0.1.22.04.3 . Ubuntu's tar utility faces a critical flaw allowing file overwrites via crafted archives. Update your system now.. Ubuntu Tar Security Update, Critical Tar Vulnerability, Secure File Archiving. . Severity: Critical. LinuxSecurity.com Team
Jun 30, 2026
•Critical
Ubuntu
202
security advisoryupdateimportantopenSUSE Tar Important File Injection Issues Fix Advisory 2026-21070-1
An update that solves 2 vulnerabilities and has 3 bug fixes can now be installed.. openSUSE security update: security update for tar ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21070-1 Rating: important References: * bsc#1261900 * bsc#1265450 * bsc#1267189 Cross-References: * CVE-2025-45582 * CVE-2026-5704 CVSS scores: * CVE-2025-45582 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-45582 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-5704 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 2 vulnerabilities and has 3 bug fixes can now be installed. Description: This update for tar fixes the following issues - CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900). - Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-1092=1 Package List: - openSUSE Leap 16.0: tar-1.35-160000.4.1 tar-backup-scripts-1.35-160000.4.1 tar-doc-1.35-160000.4.1 tar-lang-1.35-160000.4.1 tar-rmt-1.35-160000.4.1 tar-tests-1.35-160000.4.1 References: * https://www.suse.com/security/cve/CVE-2025-45582.html * https://www.suse.com/security/cve/CVE-2026-5704.html . Fixes for 2 vulnerabilities and bug fixes for openSUSE's tar. Apply patches to enhance security immediately.. openSUSE security updates. . Severity: Important. LinuxSecurity.com Team
Jun 30, 2026
•Important
OpenSUSE
100
security advisorySuSEpatchSUSE Tar Important File Injection Fix Advisory 2026-22289-1
An update that solves two vulnerabilities and has one fix can now be installed.. # Security update for tar Announcement ID: SUSE-SU-2026:22289-1 Release Date: 2026-06-26T09:03:48Z Rating: important References: * bsc#1261900 * bsc#1265450 * bsc#1267189 Cross-References: * CVE-2025-45582 * CVE-2026-5704 CVSS scores: * CVE-2025-45582 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-45582 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-45582 ( NVD ): 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L * CVE-2026-5704 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-5704 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( NVD ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: * SUSE Linux Micro 6.2 An update that solves two vulnerabilities and has one fix can now be installed. ## Description: This update for tar fixes the following issues * CVE-2026-5704: crafted archives can be used to to hide file injection (bsc#1261900). * Fix --dereference/-h not working properly after CVE-2025-45582 fix (bsc#1265450). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.2 zypper in -t patch SUSE-SL-Micro-6.2-1092=1 ## Package List: * SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64) * tar-debugsource-1.35-160000.4.1 * tar-1.35-160000.4.1 * tar-debuginfo-1.35-160000.4.1 ## References: * https://www.suse.com/security/cve/CVE-2025-45582.html * https://www.suse.com/security/cve/CVE-2026-5704.html * https://bugzilla.suse.com/show_bug.cgi?id=1261900 * https://bugzilla.suse.com/show_bug.cgi?id=1265450 *https://bugzilla.suse.com/show_bug.cgi?id=1267189 . Maintain security with this SUSE update for tar, addressing important issues and the need for immediate patch installation.. SUSE tar security update, important security patch, file injection issue. . Severity: Important. LinuxSecurity.com Team
Jun 29, 2026
•Important
SuSE
202
security advisorymoderatesystem accessopenSUSE Tumbleweed Tar Moderate Update CVE-2026-5704 Advisory 2026-11125-1
An update that solves one vulnerability can now be installed.. # tar-1.35-8.1 on GA media Announcement ID: openSUSE-SU-2026:11125-1 Rating: moderate Cross-References: * CVE-2026-5704 CVSS scores: * CVE-2026-5704 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-5704 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the tar-1.35-8.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * tar 1.35-8.1 * tar-backup-scripts 1.35-8.1 * tar-doc 1.35-8.1 * tar-lang 1.35-8.1 * tar-rmt 1.35-8.1 * tar-tests 1.35-8.1 ## References: * https://www.suse.com/security/cve/CVE-2026-5704.html . An update for tar-1.35-8.1 on openSUSE Tumbleweed resolves a moderate security issue related to CVE-2026-5704.. openSUSE,Tar Security Update,CVE-2026-5704,Moderate Vuln,Security Patch. . Severity: moderate. LinuxSecurity.com Team
Jun 28, 2026
•moderate
OpenSUSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!