CVE-2023-39804

2023-11-3000:00:00

ubuntu.com

cve-2023-39804

gnu tar

extension attributes

pax archive

application crash

xheader.c

security vulnerability

9.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

In GNU tar before 1.35, mishandled extension attributes in a PAX archive
can lead to an application crash in xheader.c.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/tar/+bug/2029464>

Notes

Author	Note
alexmurray	Fixed in upstream version 1.35

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchtar< 1.29b-2ubuntu0.4+esm1UNKNOWN
ubuntu20.04noarchtar< 1.30+dfsg-7ubuntu0.20.04.4UNKNOWN
ubuntu22.04noarchtar< 1.34+dfsg-1ubuntu0.1.22.04.2UNKNOWN
ubuntu23.04noarchtar< 1.34+dfsg-1.2ubuntu0.2UNKNOWN
ubuntu23.10noarchtar< 1.34+dfsg-1.2ubuntu1.1UNKNOWN
ubuntu14.04noarchtar< 1.27.1-1ubuntu0.1+esm4UNKNOWN
ubuntu16.04noarchtar< 1.28-2.1ubuntu0.2+esm3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	tar	< 1.29b-2ubuntu0.4+esm1	UNKNOWN
ubuntu	20.04	noarch	tar	< 1.30+dfsg-7ubuntu0.20.04.4	UNKNOWN
ubuntu	22.04	noarch	tar	< 1.34+dfsg-1ubuntu0.1.22.04.2	UNKNOWN
ubuntu	23.04	noarch	tar	< 1.34+dfsg-1.2ubuntu0.2	UNKNOWN
ubuntu	23.10	noarch	tar	< 1.34+dfsg-1.2ubuntu1.1	UNKNOWN
ubuntu	14.04	noarch	tar	< 1.27.1-1ubuntu0.1+esm4	UNKNOWN
ubuntu	16.04	noarch	tar	< 1.28-2.1ubuntu0.2+esm3	UNKNOWN