Debian: Security Advisory (DLA-3432-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-2868

A remote command injection vulnerability exists in the Barracuda Email Security Gateway appliance form factor only product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file tape archives. The vulnerability ste...

Oracle Linux 8 : libtar (ELSA-2023-2898)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-2898 advisory. - fix use-after-free bugs introduced by incorrect memleak fixes CVE-2021-33640 - fix memory leaks through gnulongname,link CVE-2021-33645 CVE-2021-3364...

PT-2023-2960

Name of the Vulnerable Software and Affected Versions Barracuda Email Security Gateway ESG versions 5.1.3.001 through 9.2.0.006 Description A remote command injection issue exists in the Barracuda Email Security Gateway ESG appliance. The root cause is a failure to properly sanitize user-supplied...

Barracuda Email Security Gateway 命令注入漏洞

Barracuda Email Security Gateway is an email security gateway from Barracuda that manages and filters all inbound and outbound email traffic to protect organizations from email threats and data breaches. A security vulnerability exists in Barracuda Email Security Gateway versions 5.1.3.001 throug...

Barracuda ESG TAR Filename Command Injection

This module exploits CVE-2023-2868, a command injection vulnerability in Barracuda Email Security Gateway ESG appliances. The vulnerability exists in how the ESG processes TAR file attachments - filenames containing shell metacharacters backticks are passed directly to shell commands during...

USN-5900-2: tar vulnerability

USN-5900-1 fixed vulnerabilities in tar. This update fixes it to Ubuntu 23.04. Original advisory details: It was discovered that tar incorrectly handled certain files. An attacker could possibly use this issue to expose sensitive information or cause a crash...

Ubuntu: Security Advisory (USN-5900-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 23.04 : tar vulnerability (USN-5900-2)

The remote Ubuntu 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-5900-2 advisory. USN-5900-1 fixed vulnerabilities in tar. This update fixes it to Ubuntu 23.04. Tenable has extracted the preceding description block directly from the Ubuntu security...

AlmaLinux 8 : libtar (ALSA-2023:2898)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:2898 advisory. - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc0 for a variable gnulonglink,...

RHEL 8 : Image Builder (RHSA-2023:2780)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2780 advisory. Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood...

tar bug fix and enhancement update

An update is available for tar. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 8.8...

EulerOS 2.0 SP10 : tar (EulerOS-SA-2023-1964)

According to the versions of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change th...

VulnCheck KEV: CVE-2023-2868

Barracuda Email Security Gateway ESG appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection...

EulerOS 2.0 SP10 : tar (EulerOS-SA-2023-1986)

According to the versions of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change th...

Huawei EulerOS: Security Advisory for tar (EulerOS-SA-2023-1986)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for tar (EulerOS-SA-2023-1964)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Low: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers

A flaw was found in the golang package, where Reader.Read does not set a limit on the maximum size of file headers. After fixing, Reader.Read limits the maximum size of header blocks to 1 MiB. This flaw allows a maliciously crafted archive to cause Read to allocate unbounded amounts of memory,...

libtar: out-of-bounds read in gnu_longlink

A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with the size in the header struct being 0 to trigger a calling of malloc0 for a variable gnulonglink, causing an out-of-bounds read...