K000159077: GNU Tar vulnerability CVE-2019-9923

Security Advisory Description paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. CVE-2019-9923 There is no impact; F5 products are not affected by this vulnerability. Note : F5 previously reported...

golang: archive/tar: Unbounded allocation when parsing GNU sparse map

A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go...

CVE-2015-8888

CVE-2015-8888 affects the Qualcomm component in Android on Nexus 5. An integer overflow in the file app/aboot/aboot.c can be triggered by crafted block count and block size in a sparse header, allowing bypass of access restrictions. This is tied to Android prior to 2016-07-05 (Android bug 2882246...