GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-tar | Feb 22, 2023 | Jan 30, 2023 | |
| Alpine Linux | alpine-linux-upgrade-tar | Mar 26, 2024 | Jan 30, 2023 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-taramazon-linux-ami-2-upgrade-tar-debuginfo | Mar 22, 2023 | Jan 30, 2023 | |
| Amazon_linux | — | amazon-linux-upgrade-tar | Mar 23, 2023 | Jan 30, 2023 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-taramazon-linux-2023-upgrade-tar-debuginfoamazon-linux-2023-upgrade-tar-debugsource | Feb 17, 2025 | Apr 30, 2022 | |
| Centos_linux | — | centos-upgrade-tarcentos-upgrade-tar-debuginfocentos-upgrade-tar-debugsource | Feb 22, 2023 | Jan 30, 2023 |
| Debian | debian-upgrade-tar | Jul 30, 2024 | Jan 30, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-app-arch-tar | Feb 19, 2024 | Jan 30, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-tar | May 18, 2023 | Jan 30, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-tar | Jul 5, 2023 | Jan 30, 2023 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-tar | Jun 9, 2023 | Jan 30, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tar | Jun 9, 2023 | Jan 30, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-tar | May 10, 2023 | Jan 30, 2023 | |
| Nutanix Ahv | nutanix-ahv-upgrade-latest | Jun 5, 2026 | Sep 4, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-tar | Feb 22, 2023 | Apr 30, 2022 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-tarredhat-upgrade-tar-debuginforedhat-upgrade-tar-debugsource | Feb 22, 2023 | Jan 30, 2023 | |
| Rocky_linux | rocky-upgrade-tarrocky-upgrade-tar-debuginforocky-upgrade-tar-debugsource | Mar 12, 2024 | Jan 30, 2023 | |
| Suse | — | suse-upgrade-tarsuse-upgrade-tar-backup-scriptssuse-upgrade-tar-docsuse-upgrade-tar-langsuse-upgrade-tar-rmtsuse-upgrade-tar-tests | Feb 21, 2023 | Jan 30, 2023 |
| Ubuntu | ubuntu-pro-upgrade-tarubuntu-upgrade-tar | Mar 22, 2023 | Jan 30, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jan 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub