Improper Handling of Length Parameter Inconsistency in Compress

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package...

Exploit for Use of Hard-coded Credentials in Glpi-Project Glpi

CVE-2020-5248 POC 환경 구성 및 테스트 입니다. 테스트 방법 - 환경 구성 v...

containers/storage: DoS via malicious image

A deadlock vulnerability was found in github.com/containers/storage. When a container image is processed, each layer is unpacked using tar. If one of those layers is not a valid tar archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar...

UBUNTU-CVE-2021-32610

In ArchiveTar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193...

PT-2021-5776 · Npm +9 · Node-Tar +9

Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 3.2.3 node-tar versions prior to 4.4.15 node-tar versions prior to 5.0.7 node-tar versions prior to 6.1.2 Description: The issue is related to insufficient symlink protection in the node-tar module for handling tar...

OESA-2021-1277 ant security update

Ant is a Java based build tool. In theory it is kind of like "make" without makes wrinkles and with the full portability of pure java code. Security Fixes: When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out...

PT-2021-5756 · Npm +7 · Node-Tar +7

Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 3.3.2, 4.4.14, 5.0.6, and 6.1.1 Description: The issue is related to the node-tar module for handling tar archives in Node.js, which has a problem with incorrect filtering of the '/' character sequence. This could...

CVE-2020-5370

Dell EMC OpenManage Enterprise OME versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to overwrite arbitrary files via directory traversal sequences using a crafted tar fi...

CVE-2020-5370

Dell EMC OpenManage Enterprise OME versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to overwrite arbitrary files via directory traversal sequences using a crafted tar fi...

DELL EMC OpenManage Enterprise 路径遍历漏洞

DELL EMC OpenManage Enterprise is an intuitive infrastructure management console from Dell DELL, U.S.A. OpenManage Enterprise is a system management and monitoring application that provides a comprehensive view of Dell EMC servers, chassis, storage devices, and network switches on an enterprise...

DRUPAL-CORE-2021-004

The Drupal project uses the pear Archive\Tar library, which has released a security update that impacts Drupal. The vulnerability is mitigated by the fact that Drupal core's use of the Archive\Tar library is not vulnerable, as it does not permit symlinks. Exploitation may be possible if contrib o...

CVE-2020-21933

An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in the log tar package...

CVE-2020-21933

An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in the log tar package...

PT-2021-5004 · Unknown +9 · Archive Tar +9

Name of the Vulnerable Software and Affected Versions: Archive Tar versions prior to 1.4.14 Description: The issue is related to incorrect link resolution before file access, potentially allowing an attacker to impact data integrity, availability, and confidentiality. It involves symlinks referri...

Backdrop CMS 后置链接漏洞

Backdrop CMS is an open source content management system CMS. A backlink vulnerability exists in Backdrop CMS. The vulnerability stems from the use of the third-party PEAR ArchiveTar library and could allow a remote attacker to execute arbitrary code on the system...

Links in archive can create arbitrary directories

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point. rust use std::io, io::Result; use tar::Archive,...

RUSTSEC-2021-0080 Links in archive can create arbitrary directories

When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point. rust use std::io, io::Result; use tar::Archive,...

Huawei EulerOS: Security Advisory for tar (EulerOS-SA-2021-2232)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Ant TAR archive denial of service vulnerability

...

EulerOS 2.0 SP5 : tar (EulerOS-SA-2021-2232)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in the src/list.c of tar. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of...