RLSA-2026:61586 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

tar security, bug fix, and enhancement update

An update is available for tar. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The GNU tar program can save multiple files in an archive and restore files from...

RockyLinux 10 : tar (RLSA-2026:61586)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61586 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path esca...

tar: tar: Hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

AlmaLinux 10 : tar (ALSA-2026:61586)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:61586 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escap...

MiracleLinux 9 : tar-1.34-13.el9_8 (AXSA:2026-1733:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1733:03 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path...

Moderate: Red Hat Security Advisory: tar security, bug fix, and enhancement update

An update for tar is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

tar: tar: Hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

RLSA-2026:61581 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

tar security, bug fix, and enhancement update

An update is available for tar. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The GNU tar program can save multiple files in an archive and restore files from ...

AlmaLinux 9 : tar (ALSA-2026:61581)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:61581 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape...

tar: tar: Hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

Moderate: Red Hat Security Advisory: tar security, bug fix, and enhancement update

An update for tar is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

ALSA-2026:61581 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

ALSA-2026:61586 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

CentOS 9 : tar-1.34-13.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the tar-1.34-13.el9 build changelog. - A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

Malicious code in dolyame-ui-inputdate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from...

MAL-2026-13509 Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...