Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2021-33643

libtar: out-of-bounds read in gnu_longlink

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Feep Openatom and 1 more
Products
Fedora Libtar Openeuler and 1 more
CVE-2021-33646

libtar: memory leak found in th_read() function

The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Feep Openatom and 1 more
Products
Fedora Libtar Openeuler and 1 more
CVE-2021-33645

libtar: memory leak found in th_read() function

The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Feep Openatom and 1 more
Products
Fedora Libtar Openeuler and 1 more
CVE-2021-33644

libtar: out-of-bounds read in gnu_longname

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Feep Openatom and 1 more
Products
Fedora Libtar Openeuler and 1 more
CVE-2013-4397

libtar: Heap-based buffer overflows by expanding a specially-crafted archive

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 5.5% KEV · Not listed
Vendors
Feep Redhat
Products
Libtar Enterprise Linux
CVE-2013-4420

libtar: missing validation of file names

Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.

CVSS 2.0 · 5.8 Medium EPSS 3.4% KEV · Not listed
Vendors
Feep
Products
Libtar