Описание
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
A flaw was found in the Tar package. When attempting to read files with old V7 tar format with a specially crafted checksum, an invalid memory read may occur. An attacker could possibly use this issue to expose sensitive information or cause a crash.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | tar | Out of support scope | ||
| Red Hat Enterprise Linux 7 | tar | Will not fix | ||
| Red Hat Enterprise Linux 8 | tar | Fixed | RHSA-2023:0842 | 21.02.2023 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | tar | Fixed | RHSA-2023:5610 | 10.10.2023 |
| Red Hat Enterprise Linux 9 | tar | Fixed | RHSA-2023:0959 | 28.02.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in ...
EPSS
5.5 Medium
CVSS3