SUSE-SU-2026:23355-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

GO-2026-6253 moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...

AZL-98211 CVE-2026-79655 affecting package sos 4.6.1-2

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A path traversal flaw in the sos clean utility (part of the sos package) allows a local attacker to perform arbitrary file creation or overwrite . The root cause is improper validation of symlink and hardlink targets during tar archive extraction. A specially crafted tar archive can cause files t...

CVE-2026-79655 Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

EUVD-2026-65492

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655 Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655: Improper Link Resolution Before File Access

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

PT-2026-81315

Name of the Vulnerable Software and Affected Versions sos affected versions not specified Description A flaw in the sos clean utility within the sos package allows a local attacker to create or overwrite arbitrary files. The issue stems from a path traversal flaw during the extraction of tar...

Linux Distros Unpatched Vulnerability : CVE-2026-79655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By...

BIT-DOCKER-CLI-2026-17106 Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

PT-2026-79855

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:21611-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21611-1 advisory. Changes in apptainer: - Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106: The tar extraction routines in moby/go-archive do not confine...

Security update for apptainer (important)

openSUSE security update: security update for apptainer ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21611-1 Rating: important References: bsc1275248 Cross-References: CVE-2026-17106 CVSS scores: CVE-2026-17106 SUSE : 7.1...

CVE-2026-44517

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...

Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...