https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:36:51 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-42497 <p><strong>Affected:</strong> Alpaquita:23: perl, Alpaquita:25: perl, Alpaquita:stream: perl, BellSoft Hardened Containers:23: perl, BellSoft Hardened Containers:25: perl, BellSoft Hardened Containers:stream: perl</p> <p><strong>Affected:</strong> Alpaquita:23: perl, Alpaquita:25: perl, Alpaquita:stream: perl, BellSoft Hardened Containers:23: perl, BellSoft Hardened Containers:25: perl, BellSoft Hardened Containers:stream: perl</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-42497 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0986 https://cve.radiocsirt.org/vuln/euvd-2026-322378 EUVD-2026-322378 https://cve.radiocsirt.org/vuln/euvd-2026-322378 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42497 <p>Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.</p> <p>_make_special_file() passes the tar header&#39;s linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file&#39;s inode.</p> <p>A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header&#39;s mode, owner, and timestamps to the shared inode during extraction alone.</p> <p>Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.</p> <p>_make_special_file() passes the tar header&#39;s linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file&#39;s inode.</p> <p>A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header&#39;s mode, owner, and timestamps to the shared inode during extraction alone.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42497 https://cve.radiocsirt.org/vuln/ghsa-fcfm-93gv-wh6f <p>Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.</p> <p>_make_special_file() passes the tar header&#39;s linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file&#39;s inode.</p> <p>A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header&#39;s mode, owner, and timestamps to the shared inode during extraction alone.</p> <p>Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.</p> <p>_make_special_file() passes the tar header&#39;s linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file&#39;s inode.</p> <p>A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header&#39;s mode, owner, and timestamps to the shared inode during extraction alone.</p> https://cve.radiocsirt.org/vuln/ghsa-fcfm-93gv-wh6f https://cve.radiocsirt.org/vuln/msrc_cve-2026-42497 msrc_CVE-2026-42497 https://cve.radiocsirt.org/vuln/msrc_cve-2026-42497 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42497 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:25.10: perl, Ubuntu:26.04:LTS: perl</p> <p>Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header&#39;s linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file&#39;s inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header&#39;s mode, owner, and timestamps to the shared inode during extraction alone.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:25.10: perl, Ubuntu:26.04:LTS: perl</p> <p>Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header&#39;s linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file&#39;s inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header&#39;s mode, owner, and timestamps to the shared inode during extraction alone.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42497 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2666 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cPanel cPanel/WHM ausnutzen, um vertrauliche Informationen preiszugeben oder Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cPanel cPanel/WHM ausnutzen, um vertrauliche Informationen preiszugeben oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2666