cve-tarmageddon

CVE-2025-62518: TARmageddon This repository demonstrates a critical bug in tokio-tar and related async Rust tar libraries where PAX extended header size overrides are not applied before calculating the next header position. Bug Summary Root Cause: When processing tar files with PAX extended heade...

pax

pax Exploit padding oracles for fun and profit! Pax PAdding oracle eXploiter is a tool for exploiting padding oracles in order to: 1. Obtain plaintext for a given piece of CBC encrypted data. 2. Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by...

ParrotSec-Linux-Hardening-Project

ParrotSec Linux - Public Kiosk Project Designing & Implementing A restricted & Trustworthy Environment Hardened kernel - GrSecurity Patched Kernel - PaX Hardening - x PaXctl - x PaXTest - x PaXctld - x Hardened Kernel Runtime Parameters - x Kernel Self Protection Project KSPP - x pti=on - Kernel...

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

pentoo-overlay

Pentoo Penetration Testing Overlay Gentoo overlay for security tools as well as the heart of the Pentoo Livecd Pentoo is a Live CD and Live USB designed for penetration testing and security assessment. Based on Gentoo Linux, Pentoo is provided both as 32 and 64 bit installable livecd. Pentoo is...

pax

pax ¡Explota oráculos de padding por diversión y beneficio! Pax PAdding oracle eXploiter es una herramienta para explotar oráculos de padding con el fin de: 1. Obtener texto plano para un fragmento dado de datos cifrados con CBC. 2. Obtener bytes cifrados para un fragmento dado de texto plano,...

Astra Linux – Vulnerability in Python 2.7, Pypy

In Lib/tarfile.py in Python 3.8.3, an attacker can create a TAR archive that causes an infinite loop when opened using tarfile.open, due to the lack of header validation in procpax...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2025:1766137892)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1766137892 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

AlmaLinux 9.2 [TuxCare] Security Update: tar (ALMALINUX9.2:CLSA-2026:1778820779)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778820779 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 Note...

AlmaLinux 9.2 [TuxCare] Security Update: delve (ALMALINUX9.2:CLSA-2025:1765985189)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765985189 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

AlmaLinux 9.6 [TuxCare] Security Update: delve (ALMALINUX9.6:CLSA-2025:1766232861)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1766232861 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1765987793)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765987793 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.2:CLSA-2025:1765293700)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765293700 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2025:1766137892)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1766137892 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2025:1765379708)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765379708 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

CentOS Linux 8.4 [TuxCare] Security Update: tar (CENTOS8.4:CLSA-2025:1762536241)

The CentOS Linux 8.4 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1762536241 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 Note...

CentOS Linux 8.5 [TuxCare] Security Update: tar (CENTOS8.5:CLSA-2025:1762535960)

The CentOS Linux 8.5 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1762535960 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 Note...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2025:1764331947)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764331947 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

Rocky Linux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1778828497)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778828497 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 No...

AlmaLinux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1778828497)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778828497 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 Note...