Most recent entries from all

ALSA-2026:61581 — Moderate: tar security, bug fix, and enhancement update

Affected: AlmaLinux:9: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704) * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477) * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

* tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

certfr-2026-avi-1249 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-1249

EUVD-2026-373901

fkie_cve-2026-5704

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

GHSA-jqqw-37x4-9rwj

msrc_CVE-2026-5704 — Tar: tar: hidden file injection via crafted archives

msrc_CVE-2026-5704

OESA-2026-3223 — tar security update

Affected: openEuler:24.03-LTS-SP1: tar, openEuler:24.03-LTS-SP3: tar, openEuler:24.03-LTS-SP4: tar, openEuler:20.03-LTS-SP4: tar, openEuler:22.03-LTS-SP4: tar

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fix(es):

openSUSE-SU-2026:11125-1 — tar-1.35-8.1 on GA media

tar-1.35-8.1 on GA media

RHSA-2026:61783 — Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

webpack-dev-middleware: lack of URL validation may lead to file leak curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect tar: tar: Hidden file injection via crafted archives fast-uri: fast-uri: URI authority bypass due to improper delimiter handling libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free curl: curl: Insecure connection establishment due to TLS configuration mismatch curl: curl: Man-in-the-middle attack via SSH host key bypass sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility gzip: gzip: Information disclosure via global buffer overflow in LZH decompression python-idna: idna: Denial of Service via…

RLSA-2026:61581 — Moderate: tar security, bug fix, and enhancement update

Affected: Rocky Linux:9: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)

* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)

* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

* tar: --one-top-level with absolute path fails [rhel-9] (JIRA:Rocky Linux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22289-1 — Security update for tar

Security update for tar

UBUNTU-CVE-2026-5704

Affected: Ubuntu:Pro:14.04:LTS: tar, Ubuntu:Pro:16.04:LTS: tar, Ubuntu:Pro:18.04:LTS: tar, Ubuntu:Pro:20.04:LTS: tar, Ubuntu:22.04:LTS: tar, Ubuntu:24.04:LTS: tar, Ubuntu:25.10: tar, Ubuntu:26.04:LTS: tar

WID-SEC-W-2026-1057 — GNU tar: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein lokaler Angreifer kann eine Schwachstelle in GNU tar ausnutzen, um Sicherheitsvorkehrungen zu umgehen.