CVE-2023-39804

CVE-2023-39804 corresponds to a GNU tar issue where mishandled extension attributes in a PAX archive can crash an application via xheader.c. The connected IBM bulletin maps this CVE to IBM API Connect onPrem v12 (12.1.0.0) and lists remediation by upgrading to v12.1.0.1. The IBM advisory presents...

CVE-2010-0624

CVE-2010-0624 describes a heap-based buffer overflow in the rmt_read__ function of lib/rtapelib.c within the rmt client of GNU tar (before 1.23) and GNU cpio (before 2.11). A remote rmt server sending more data than requested (in archives whose filenames contain a colon) can cause memory corrupti...

CVE-2007-4131

CVE-2007-4131 is a directory traversal vulnerability in GNU tar (contains_dot_dot in src/names.c) that lets a user-assisted attacker cause tar to overwrite arbitrary files when processing crafted archives containing //.. sequences in directory symlinks. Impact is that extraction could write outsi...