A vulnerability has been discovered in GNU Tar which may lead to an out of bounds read.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.34-r3 | >= 1.34-r3 |
The GNU Tar program provides the ability to create tar archives, as well as various other kinds of manipulation.
A vulnerability have been discovered in GNU Tar. Please review the CVE identifier referenced below for details.
GNU Tar has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs via a V7 archive in which mtime has approximately 11 whitespace characters.
There is no known workaround at this time.
All GNU Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.34-r3"
A vulnerability in Tar could lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.34 | >= 1.34 |
The Tar program provides the ability to create and manipulate tar archives.
It was discovered that GNU Tar had a memory leak when processing archive headers.
A remote attacker could entice a user to open a specially crafted archive using Tar, possibly resulting in a Denial of Service condition.
There is no known workaround at this time.
All Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.34"
A vulnerability in Tar could led to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.30-r1 | >= 1.30-r1 |
The Tar program provides the ability to create and manipulate tar archives.
The sparse_dump_region function in sparse.c file in Tar allows an infinite loop using the --sparse option.
A local attacker could cause a Denial of Service condition by modifying a file that is supposed to be archived by a different user’s process (e.g., a system backup running as root).
There is no known workaround at this time.
All Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.30-r1"
A path traversal attack in Tar may lead to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.29-r1 | >= 1.29-r1 |
The Tar program provides the ability to create and manipulate tar archives.
Tar attempts to avoid path traversal attacks by removing offending parts of the element name at extract. This sanitizing leads to a vulnerability where the attacker can bypass the path name(s) specified on the command line.
The attacker can create a crafted tar archive that, if extracted by the victim, replaces files and directories the victim has access to in the target directory, regardless of the path name(s) specified on the command line.
There is no known workaround at this time.
All Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.29-r1"
A buffer overflow flaw in GNU Tar could result in execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.23 | >= 1.23 |
GNU Tar is a utility to create archives as well as add and extract files from archives.
GNU Tar is vulnerable to a boundary error in the rmt_read__ function in lib/rtapelib.c, which could cause a heap-based buffer overflow.
A remote attacker could entice the user to load a specially crafted archive, possibly resulting in the execution of arbitrary code or a Denial of Service.
There is no known workaround at this time.
All GNU Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.23"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since July 18, 2010. It is likely that your system is already no longer affected by this issue.
A directory traversal vulnerability has been discovered in GNU Tar.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.18-r2 | >= 1.18-r2 |
The GNU Tar program provides the ability to create tar archives, as well as various other kinds of manipulation.
Dmitry V. Levin discovered a directory traversal vulnerability in the contains_dot_dot() function in file src/names.c.
By enticing a user to extract a specially crafted tar archive, a remote attacker could extract files to arbitrary locations outside of the specified directory with the permissions of the user running GNU Tar.
There is no known workaround at this time.
All GNU Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.18-r2"
Tar is vulnerable to directory traversal possibly allowing for the overwriting of arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.16-r2 | >= 1.16-r2 |
The Tar program provides the ability to create and manipulate tar archives.
Tar does not properly extract archive elements using the GNUTYPE_NAMES record name, allowing files to be created at arbitrary locations using symlinks. Once a symlink is extracted, files after the symlink in the archive will be extracted to the destination of the symlink.
An attacker could entice a user to extract a specially crafted tar archive, possibly allowing for the overwriting of arbitrary files on the system extracting the archive.
There is no known workaround at this time.
All Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.16-r2"
A malicious tar archive could trigger a Buffer overflow in GNU tar, potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/tar | * | < 1.15.1-r1 | >= 1.15.1-r1 |
GNU tar is the standard GNU utility for creating and manipulating tar archives, a common format used for creating backups and distributing files on UNIX-like systems.
Jim Meyering discovered a flaw in the handling of certain header fields that could result in a buffer overflow when extracting or listing the contents of an archive.
A remote attacker could construct a malicious tar archive that could potentially execute arbitrary code with the privileges of the user running GNU tar.
There is no known workaround at this time.
All GNU tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/tar-1.15.1-r1"