Поиск уязвимостей
Количество 29
Количество 29
ALT-PU-2023-8713
ALT-PU-2023-8713: package `tar` update to version 1.35.0.20.1cdad4cc-alt1
CVE-2023-39804
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.
CVE-2023-39804
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.
CVE-2023-39804
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.
CVE-2023-39804
CVE-2023-39804
In GNU tar before 1.35, mishandled extension attributes in a PAX archi ...
CVE-2025-45582
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in...
CVE-2025-45582
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in...
CVE-2025-45582
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in wh
CVE-2025-45582
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in wh
CVE-2025-45582
GNU Tar through 1.35 allows file overwrite via directory traversal in ...
SUSE-SU-2024:0071-1
Security update for tar
SUSE-SU-2024:0070-1
Security update for tar
ROS-20240425-02
Уязвимость tar
GHSA-5pvw-wf9w-xx8v
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.
openSUSE-SU-2026:20472-1
Security update for tar
SUSE-SU-2026:2615-1
Security update for tar
SUSE-SU-2026:1177-1
Security update for tar
RLSA-2026:0067
Moderate: tar security update
RLSA-2026:0002
Moderate: tar security update
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| ALT-PU-2023-8713 ALT-PU-2023-8713: package `tar` update to version 1.35.0.20.1cdad4cc-alt1 | CVSS3: 6.2 | около 3 лет назад | |
 | CVE-2023-39804 In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. | CVSS3: 6.2 | 0% Низкий | больше 2 лет назад |
 | CVE-2023-39804 In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. | CVSS3: 3.3 | 0% Низкий | почти 3 года назад |
 | CVE-2023-39804 In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. | CVSS3: 6.2 | 0% Низкий | больше 2 лет назад |
 | CVSS3: 6.2 | 0% Низкий | почти 2 года назад | |
| CVE-2023-39804 In GNU tar before 1.35, mishandled extension attributes in a PAX archi ... | CVSS3: 6.2 | 0% Низкий | больше 2 лет назад |
| CVE-2025-45582 GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in... | CVSS3: 4.1 | 0% Низкий | больше 1 года назад |
| CVE-2025-45582 GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in... | CVSS3: 5.6 | 0% Низкий | больше 1 года назад |
| CVE-2025-45582 GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in wh | CVSS3: 4.1 | 0% Низкий | больше 1 года назад |
| CVE-2025-45582 GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in wh | 0% Низкий | около 1 года назад | |
| CVE-2025-45582 GNU Tar through 1.35 allows file overwrite via directory traversal in ... | CVSS3: 4.1 | 0% Низкий | больше 1 года назад |
 | SUSE-SU-2024:0071-1 Security update for tar | 0% Низкий | почти 3 года назад | |
| SUSE-SU-2024:0070-1 Security update for tar | 0% Низкий | почти 3 года назад | |
 | ROS-20240425-02 Уязвимость tar | CVSS3: 2.8 | 0% Низкий | больше 2 лет назад |
| GHSA-5pvw-wf9w-xx8v In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. | CVSS3: 6.2 | 0% Низкий | больше 2 лет назад |
| openSUSE-SU-2026:20472-1 Security update for tar | 0% Низкий | 7 месяцев назад | |
| SUSE-SU-2026:2615-1 Security update for tar | 0% Низкий | 5 месяцев назад | |
| SUSE-SU-2026:1177-1 Security update for tar | 0% Низкий | 7 месяцев назад | |
 | RLSA-2026:0067 Moderate: tar security update | 0% Низкий | 10 месяцев назад | |
| RLSA-2026:0002 Moderate: tar security update | 0% Низкий | 10 месяцев назад |
Уязвимостей на страницу