Security update for python310

This update for python310 fixes the following issues: CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets bsc1247249. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...

SUSE-SU-2025:02948-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets bsc1247249...

K000153107: Python tarfile Vulnerabilities CVE-2025-4138, CVE-2025-4330

Security Advisory Description CVE-2025-4138 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar...

TencentOS Server 4: vim (TSSA-2025:0646)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0646 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

[SECURITY] Fedora 42 Update: libarchive-3.8.1-1.fc42

Libarchive is a programming library that can create and read several different streaming archive formats, including most popular tar variants, several cpio formats, and both BSD and GNU ar variants. It can also write shar archives and read ISO9660 CDROM images and ZIP archives...

PT-2025-45112

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.8.1 Description The software is a BSD-licensed C programming library providing streaming access to various archive formats like tar, cpio, pax, zip, and ISO9660 images. It includes bsdtar and bsdcpio...

Linux Distros Unpatched Vulnerability : CVE-2021-37712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The npm package tar aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2021-37701

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The npm package tar aka node-tar before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability...

RHEL 9 : libarchive (RHSA-2025:14142)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:14142 advisory. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM...

The vulnerability of the tar-fs package from the tar-stream library in the Node.js software platform allows a hacker to write arbitrary files.

The vulnerability of the tar-fs package from the tar-stream library for processing tar format files on Node.js software platforms is related to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability could allow a remote attacker to write arbitrary fil...

ROS-20250819-06

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of restricted directory. Python programming language interpreter CPython functions TarFile.extractall and...

Linux Distros Unpatched Vulnerability : CVE-2025-4138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - jython - Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of...

Linux Distros Unpatched Vulnerability : CVE-2025-4330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - jython - Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of...

Amazon Linux 2 : python (ALAS-2025-2961)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2961 advisory. There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation...

Medium: vim

Issue Overview: Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction...

Linux Distros Unpatched Vulnerability : CVE-2021-32803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The npm package tar aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2025-1138)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1138 advisory. Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially craft...

Linux Distros Unpatched Vulnerability : CVE-2021-32804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The npm package tar aka node-tar before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient...

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2025:02802-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02802-1 advisory. - CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser bsc1244705 -...

SUSE-SU-2025:02802-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2025-6069: Fixed worst case quadratic complexity when processing certain crafted malformed inputs with HTMLParser bsc1244705 - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets bsc1247249 Other fixes: -...