Most recent entries from all

ALSA-2023:2898 — Moderate: libtar security update

Affected: AlmaLinux:8: libtar

The libtar packages contain a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions.

Security Fix(es):

* libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643) * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644) * libtar: memory leak found in th_read() function (CVE-2021-33645) * libtar: memory leak found in th_read() function (CVE-2021-33646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2025-05004

EUVD-2026-329257

fkie_cve-2021-33643

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.

GHSA-j7g9-fcw9-wxcf

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.

gsd-2021-33643

msrc_CVE-2021-33643 — An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of mall…

msrc_CVE-2021-33643

OESA-2022-1807 — libtar security update

Affected: openEuler:20.03-LTS-SP1: libtar, openEuler:20.03-LTS-SP3: libtar, openEuler:22.03-LTS: libtar

Libtar is a C library for manipulating POSIX tar files. It handles adding and extracting files to/from a tar archive. Requires gcc, make, and zlib. Security Fix(es): An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.(CVE-2021-33643) An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.(CVE-2021-33644) The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.(CVE-2021-33645) The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.(CVE-2021-33646)

openSUSE-SU-2026:11092-1 — libtar-1.2.20-3.1 on GA media

libtar-1.2.20-3.1 on GA media

UBUNTU-CVE-2021-33643

Affected: Ubuntu:Pro:16.04:LTS: libtar, Ubuntu:Pro:18.04:LTS: libtar, Ubuntu:20.04:LTS: libtar, Ubuntu:22.04:LTS: libtar, Ubuntu:24.04:LTS: libtar

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.

WID-SEC-W-2023-1238 — Red Hat Enterprise Linux: Mehrere Schwachstellen in verschiedenen Komponenten

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Red Hat Enterprise Linux ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.