30 matches found
CVE-2026-116330
A flaw was found in PostgreSQL. When backing up a database using the pgdump utility with tar-format archives, the generated restore script uses a predictable restriction key. A compromised or malicious database server can exploit this flaw by injecting untrusted data, leading to arbitrary code...
CVE-2026-116330 PostgreSQL pg_dump tar restore.sql fails to block psql command injection
Untrusted data inclusion in PostgreSQL pgdump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is...
CVE-2026-116330
Untrusted data inclusion in PostgreSQL pgdump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is...
PT-2026-145820
Untrusted data inclusion in PostgreSQL pg dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is...
CVE-2026-116330: n/a PostgreSQL: Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute…
Untrusted data inclusion in PostgreSQL pgdump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is...
PT-2026-47332
Name of the Vulnerable Software and Affected Versions wojtekmach Req versions 0.1.0 through 0.6.0 Description Improper handling of highly compressed data allows attacker-controlled HTTP servers to exhaust memory in a client via decompression-bomb response bodies. The default response pipeline...
PT-2026-45517
microtar through 0.1.0 contains a stack-based buffer overflow vulnerability in the raw to header function in src/microtar.c that allows attackers to corrupt adjacent stack memory by supplying a crafted TAR archive with non-null-terminated name or linkname fields. The function uses strcpy to copy...
Unbounded allocation for old GNU sparse in archive/tar
...
Important: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
Improper Handling of Unicode Encoding
Overview tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in Path Reservations via Unicode Sharp-S ß Collisions on macOS APFS. An attacker can overwrite arbitrary files by exploiting Unicode normalization collisions ...
JLSEC-2025-244 Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar...
Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function headerpaxextension at rchivereadsupportformattar.c:1844:8...
RLSA-2025:9431 Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
RLSA-2025:9420 Moderate: libarchive security update
The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...
Libarchive: off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c
...
tar-fs Package Arbitrary File Write
The vulnerability of the tar-fs package from the tar-stream library for processing tar format files on Node.js software platforms is related to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability could allow a remote attacker to write arbitrary fil...
Libarchive Header GNU Longlink DoS
The vulnerability of the headergnulonglink function in the archivereadsupportformattar.c file of the Libarchive library is related to the execution of operations outside of the buffer. Exploiting this vulnerability could allow an attacker to cause a service failure...
SUSE CVE-2024-48615
Null Pointer Dereference vulnerability in libarchive 3.7.6 and earlier when running program bsdtar in function headerpaxextension at rchivereadsupportformattar.c:1844:8...
OESA-2025-1313 libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use . Security...
tar: heap buffer overflow at from_header() in list.c via specially crafted checksum
A flaw was found in the Tar package. When attempting to read files with old V7 tar format with a specially crafted checksum, an invalid memory read may occur. An attacker could possibly use this issue to expose sensitive information or cause a crash...
GHSA-5R98-F33J-G8H7 pnpm incorrectly parses tar archives relative to specification
Summary It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. Details The TAR format is an append-only archive format, and as such, the specification for how to update a...