Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: php (UTSA-2026-143721)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143721 advisory. phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF...

Linux Distros Unpatched Vulnerability : CVE-2026-113714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusabl...

Important: php

Issue Overview: The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined...

CLSA-2026-1791452899 tar: Fix of CVE-2026-5704

CVE-2026-5704: make listing and extraction skip archive members the same way, so a crafted archive can no longer inject a file hidden from tar -t...

CLSA-2026-1791450288 tar: Fix of CVE-2026-5704

CVE-2026-5704: make listing and extraction skip archive members the same way, so a crafted archive can no longer inject a file hidden from tar -t...

SUSE CVE-2026-6103

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

DEBIAN-CVE-2026-6103

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

AZL-104901 CVE-2026-6103 affecting package php 8.3.33-1

phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlle...

PT-2026-99113

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The phar tar number function parses the octal size field of a TAR header into a uint32 t without an overflow check. Because the field is 11 octal digits wide and can hold values up to 0x1FFFFFFFF...

PT-2026-81302

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

Security update for tar

This update for tar fixes the following issues Security fixes: CVE-2026-5704: crafted archives can be used to to hide file injection bsc1261900. Other fixes: Fix tar changing dir permissions temporarily even when using --no-overwrite-dir. Fix --dereference/-h not working properly after...

EUVD-2026-19317

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

UBUNTU-CVE-2019-10181

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox...