Astra Linux – Vulnerability in tar

In GNU tar before version 1.35, mishandling of extension attributes in a PAX archive can cause the application to crash in xheader.c...

Astra Linux – Vulnerability in tar

GNU Tar version 1.34 has a one-byte out-of-bounds read operation that allows for the use of uninitialized memory during a conditional jump. Exploitation to alter the control flow has not been demonstrated. The issue occurs in the fromheader section of the list.c file, due to a V7 archive where...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions prior to 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has a vulnerability related to arbitrary file creation/overwriting, due to insufficient symlink protection. node-tar aims to ensure that any file whose location would be modified by a symbolic link i...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent the extraction of absolute file paths by converting absolute paths into relative...

Astra Linux – Vulnerability in tar

A flaw was discovered in the src/list.c file of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The greatest threat posed by this vulnerability is to system availability...

Astra Linux – Vulnerability in tar

In the sparse.c file of GNU Tar, before version 1.32, there was a NULL pointer dereferencing issue when parsing certain archives that contained malformed extended headers...

Security Bulletin: Vulnerability in tar affects IBM Netezza Appliance

Summary The tar package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-59873 Vulnerability Details CVEID:CVE-2026-59873 DESCRIPTION: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard uppe...

Security Bulletin: Vulnerability in tar affects IBM Netezza Appliance

Summary The tar package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-59874 Vulnerability Details CVEID:CVE-2026-59874 DESCRIPTION: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-vali...

Security Bulletin:Vulnerability in Tar affects IBM Netezza Appliance

Summary The Tar package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2025-45582 Vulnerability Details CVEID:CVE-2025-45582 DESCRIPTION: GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-ste...

EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-2955)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in readcompound in src/spellfile.c when...

CLSA-2026-1782089813 TuxCare security update for tar (1 CVE)

TuxCare rebuilt tar to address 1 CVE. Fixed in 6.2.1-tuxcare.3...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses tar which is vulnerable to CVE-2026-53655

Summary IBM Maximo Application Suite - Visual Inspection component uses tar which is vulnerable to CVE-2026-53655, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-53655 DESCRIPTION: node-tar is a full-featured Tar for Node.j...

UBUNTU-CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

RLSA-2026:47058 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malform...

nodejs:24 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 9 : perl-Archive-Tar (RHSA-2026:49525)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:49525 advisory. Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also...

Linux Distros Unpatched Vulnerability : CVE-2026-18477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory...

Oracle Linux 9 : nodejs:24 (ELSA-2026-47057)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47057 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar in npm's bundled tar - Fix CVE-2026-13149 brace-expansion in npm's bundled brace-expansion Tenable has...

RLSA-2026:48033 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...