6193 matches found
python: cpython: Arbitrary writes via tarfile realpath overflow
A flaw was found in the CPython tarfile module. This vulnerability allows arbitrary filesystem writes outside the extraction directory via extracting untrusted tar archives using the TarFile.extractall or TarFile.extract methods with the extraction filter parameter set to "data" or "tar"...
Path traversal, lead to remote code execution
Description clearml's safeextract is actually NOT secure. It fails to properly handle symbolic links and hard links. When these links point to files outside the TAR archive, it can lead to arbitrary file writes, potentially resulting in remote code execution. Due to a change in th...
Path traversal, lead to remote code execution
Description In zenml's PathMaterializer class, the load function uses ispathwithindirectory to validate files during data.tar.gz extraction. While this prevents path traversal vulnerabilities, it fails to effectively detect symbolic and hard links. with tarfile.openarchivepathlocal, "r:gz" as tar...
EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2025-1690)
According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or...
EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2025-1705)
According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : listitemverbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or...
libarchive: Buffer Overflow vulnerability in libarchive
A flaw was found in the libarchive package. Affected versions of libarchive do not check a strftime return value, which can lead to a denial of service or unspecified other impacts via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be...
libarchive: Buffer Overflow vulnerability in libarchive
A flaw was found in the libarchive package. Affected versions of libarchive do not check a strftime return value, which can lead to a denial of service or unspecified other impacts via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be...
ALSA-2025:9420 Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
ALSA-2025:9431 Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
Important: python3.9
Issue Overview: Allows modifying some file metadata e.g. last modified with filter="data" or file permissions chmod with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using...
Important: python3.12
Issue Overview: Allows modifying some file metadata e.g. last modified with filter="data" or file permissions chmod with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using...
Security update for python39
This update for python39 fixes the following issues: python39 was updated from version 3.9.21 to version 3.9.23: Security issues fixed: CVE-2025-4516: Fixed blocking DecodeError handling vulnerability, which could lead to DoS bsc1243273 CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4517:...
Ubuntu 24.04 LTS / 24.10 / 25.04 : Python vulnerabilities (USN-7583-1)
The remote Ubuntu 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7583-1 advisory. It was discovered that Python incorrectly handled tar archive extraction with the filtering option. An attacker could possibly use this...
USN-7583-1: Python vulnerabilities
It was discovered that Python incorrectly handled tar archive extraction with the filtering option. An attacker could possibly use this issue to modify files in arbitrary filesystem locations and cause data loss...
USN-7583-1 python3.13, python3.12 vulnerabilities
It was discovered that Python incorrectly handled tar archive extraction with the filtering option. An attacker could possibly use this issue to modify files in arbitrary filesystem locations and cause data loss...
ROS-20250619-17
Vulnerability of CompressorStreamFactory, TarArchiveInputStream and TarFile classes of Apache Commons archiver Compress is related to uncontrolled resource consumption as a result of insufficient input data validation when processing TAR archive headers. Exploitation of the vulnerability could...
CVE-2025-32799 Conda-build Vulnerable to Path Traversal via Malicious Tar File
Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal Tarslip attacks due to improper sanitization of tar entry paths. Attackers can craft tar archives containing entries with directory traversal...
CVE-2025-32799 Conda-build Vulnerable to Path Traversal via Malicious Tar File
Conda-build contains commands and tools to build conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal Tarslip attacks due to improper sanitization of tar entry paths. Attackers can craft tar archives containing entries with directory traversal...
CVE-2025-32799
CVE-2025-32799 affects conda-build prior to 25.4.0, where tar entry path sanitization allows path traversal (Tarslip) in created/extracted archives. Attacks could overwrite files outside the extraction directory, potentially leading to privilege escalation or code execution. A fix is available in...