EulerOS Virtualization 3.0.1.0 : tar (EulerOS-SA-2019-1608)

According to the version of the tar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed...

Critical Photon OS Security Update - PHSA-2019-0016

Updates of 'dhcp', 'tar', 'python3', 'python2', 'u-boot', 'wget', 'libvirt', 'polkit' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2019-0236

Updates of 'python3', 'linux', 'tar', 'linux-esx', 'python2', 'polkit', 'libsoup' packages of Photon OS have been released...

EulerOS Virtualization for ARM 64 3.0.2.0 : tar (EulerOS-SA-2019-1624)

According to the version of the tar package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have...

EulerOS 2.0 SP2 : tar (EulerOS-SA-2019-1600)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - tar: null-pointer dereference in paxdecodeheader in sparse.c.CVE-2019-9923 Note that Tenable Network Security has extracted the preceding description...

EulerOS 2.0 SP3 : tar (EulerOS-SA-2019-1601)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - tar: null-pointer dereference in paxdecodeheader in sparse.c.CVE-2019-9923 Note that Tenable Network Security has extracted the preceding description...

CVE-2019-9949

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution as root, starting from a low-privilege user session vulnerability. The cgi-bin/webfilemgr.cgi file allows arbitrary file write by...

CVE-2019-9949

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution as root, starting from a low-privilege user session vulnerability. The cgi-bin/webfilemgr.cgi file allows arbitrary file write by...

GitLab: Local files could be overwritten in GitLab, leading to remote command execution

Summary Arbitrary file overwrite A new feature download a directory of a repository in GitLab 11.11 introduced some changes in ./internal/service/repository/archive.go of Gitaly. go func handleArchivectx context.Context, writer io.Writer, in gitalypb.GetArchiveRequest, compressCmd exec.Cmd, forma...

Unauthorised File Deletion Via Symlink

Ruby is vulnerable to unauthorised file deletion via symlink. It is possible to directory using symlink when decompressing tar...

Denial Of Service (DoS) Through Infinite Loop

Ruby is vulnerable to denial of serviceDoS attacks. This is due to negative size in tar header which may result in an infinite loop, could cause application to crash...

EulerOS Virtualization 3.0.1.0 : perl (EulerOS-SA-2019-1464)

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write...

Photon OS 1.0: Tar PHSA-2019-1.0-0228

An update of the tar package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0228. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid124868;...

rubygems: Delete directory using symlink when decompressing tar

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files which now include path-checking code for symlinks, it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could...

EulerOS Virtualization 3.0.1.0 : libarchive (EulerOS-SA-2019-1470)

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in libarchive. A specially crafted MTREE file could cause a small out-of-bounds read, potentially...

MGASA-2019-0164 Updated tar packages fix security vulnerability

paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers CVE-2019-9923...

Updated tar packages fix security vulnerability

paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers CVE-2019-9923...

EulerOS Virtualization 2.5.3 : tar (EulerOS-SA-2019-1366)

According to the version of the tar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed...

EulerOS 2.0 SP5 : tar (EulerOS-SA-2019-1347)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - tar: null-pointer dereference in paxdecodeheader in sparse.c.CVE-2019-9923 Note that Tenable Network Security has extracted the preceding description...

EulerOS 2.0 SP3 : tar (EulerOS-SA-2019-1346)

According to the version of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - tar: Infinite read loop in sparsedumpregion function in sparse.c.CVE-2018-20482 Note that Tenable Network Security has extracted the preceding...