Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.2.hum1 aarch64, x8664 tar-1.35-9.2.hum1.src src...

PT-2026-68262

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description Jenkins fails to safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. This allows attackers who control agent...

Link following vulnerability allows arbitrary file creation

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives. This allows attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1455:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1455:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1464:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1464:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

CLSA-2026-1777941831 TuxCare security update for tar (12 CVEs)

TuxCare rebuilt tar to address 12 CVEs. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1776818213 TuxCare security update for tar (2 CVEs)

TuxCare rebuilt tar to address 2 CVEs. Fixed in 1.0.3-tuxcare.3...

CLSA-2026-1774830255 TuxCare security update for tar (7 CVEs)

TuxCare rebuilt tar to address 7 CVEs. Fixed in 2.1.1-tuxcare.2...

CLSA-2026-1774484497 TuxCare security update for tar-fs (11 CVEs)

TuxCare rebuilt tar-fs to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...

CLSA-2026-1773533794 TuxCare security update for tar (8 CVEs)

TuxCare rebuilt tar to address 8 CVEs. Fixed in 6.2.1-tuxcare.1...

RLSA-2026:49525 Important: perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support...

PYSEC-2026-3606 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

SummaryPenelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such a...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1996)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1996 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1995)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1995 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Important: python3.14

Issue Overview: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value. CVE-2026-0864 The incremental HTM...

CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

UBUNTU-CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

CVE-2026-18508

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

UBUNTU-CVE-2026-18508

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...