Описание
ELSA-2026-70390: tar security, bug fix, and enhancement update (MODERATE)
[2:1.30-13]
- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)
- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).
- Upstream fix for build with libacl 2.4.0
- Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary directory at an archive-controlled path outside the extraction tree. The fix for CVE-2025-45582 already prevents exploiting this problem, so it is more a correctness and hardening change.
[2:1.30-12]
- Backport upstream changes to jailify extraction directory Includes related gnulib changes to add openat2 Fixes CVE-2025-45582
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
tar
1.30-13.el8_10
Oracle Linux x86_64
tar
1.30-13.el8_10
