GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tar | Feb 22, 2023 | Jan 30, 2023 |
| Alpine Linux | — | Upgrade tar | Mar 26, 2024 | Jan 30, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tarUpgrade tar-debuginfo | Mar 22, 2023 | Jan 30, 2023 |
| Amazon_linux | — | Upgrade tar | Mar 23, 2023 | Jan 30, 2023 |
| Amazon_linux_2023 | — | Upgrade tar-debuginfoUpgrade tarUpgrade tar-debugsource | Feb 17, 2025 | Apr 30, 2022 |
| Centos_linux | — | Upgrade tar-debuginfoUpgrade tarUpgrade tar-debugsource | Feb 22, 2023 | Jan 30, 2023 |
| Debian | — | Upgrade tar | Jul 30, 2024 | Jan 30, 2023 |
| Gentoo Linux | — | Upgrade app-arch/tar. | Feb 19, 2024 | Jan 30, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade tar | May 18, 2023 | Jan 30, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade tar | Jul 5, 2023 | Jan 30, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tar | Jun 9, 2023 | Jan 30, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tar | Jun 9, 2023 | Jan 30, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade tar | May 10, 2023 | Jan 30, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 4, 2023 |
| Oracle_linux | — | Upgrade tar | Feb 22, 2023 | Apr 30, 2022 |
| Redhat_linux | — | No solution existsUpgrade tarUpgrade tar-debuginfoUpgrade tar-debugsource | Feb 22, 2023 | Jan 30, 2023 |
| Rocky_linux | — | Upgrade tar-debuginfoUpgrade tar-debugsourceUpgrade tar | Mar 12, 2024 | Jan 30, 2023 |
| Suse | — | Upgrade tar-testsUpgrade tar-docUpgrade tarUpgrade tar-langUpgrade tar-rmtUpgrade tar-backup-scripts | Feb 21, 2023 | Jan 30, 2023 |
| Ubuntu | — | Upgrade tarUpgrade tar (Ubuntu Pro) | Mar 22, 2023 | Jan 30, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub