CVE-2022-48303

Summary: CVE-2022-48303 affects GNU tar up to version 1.34, with a one-byte out-of-bounds read in from_header/list.c for V7 archives where mtime has ~11 whitespace characters. This can cause use of uninitialized memory and a conditional jump; exploitation to alter control flow has not been demons...

CVE-2006-0300

CVE-2006-0300 refers to a buffer overflow in GNU tar versions 1.14–1.15.90 triggered by processing TAR archives with PAX extended headers. The impact described in the core CVE is a denial of service (application crash) and potential code execution via unspecified vectors. Connected advisories and...

CVE-2002-0399

CVE-2007-4559 is a directory traversal vulnerability in the tarfile module of Python, allowing a tar archive containing a .. sequence to overwrite arbitrary files during extraction. The issue is referenced in multiple Nessus advisories (e.g., Alibaba Cloud Linux 3 advisory ALINUX3-SA-2024:0040 an...

CVE-2026-5704

CVE-2026-5704 affects the tar component. A flaw allows a remote attacker to craft an archive that injects hidden files with attacker-controlled content, bypassing pre-extraction inspection and potentially introducing malicious files to a system without detection. The vulnerability is described wi...

CVE-2002-1216

CVE-2002-1216 is a variant of a tar vulnerability where GNU tar versions around 1.13.x and later (including 1.16 and 1.15.1) are affected by a symlink-based attack that can overwrite arbitrary files. The root cause is improper handling of GNUTYPE_NAMES records with symbolic links in the extract_a...