Most recent entries from all

ALSA-2026:61581 — Moderate: tar security, bug fix, and enhancement update

Affected: AlmaLinux:9: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704) * tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477) * tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

* tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

certfr-2026-avi-1249 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-1249

fkie_cve-2026-18477

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

GHSA-v7fx-gjvh-347c

msrc_CVE-2026-18477 — Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

msrc_CVE-2026-18477

OESA-2026-3597 — tar security update

Affected: openEuler:24.03-LTS-SP1: tar

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fix(es):

RHSA-2026:49361 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

RHSA-2026:61581 — security update for tar

security update for tar

RLSA-2026:61581 — Moderate: tar security, bug fix, and enhancement update

Affected: Rocky Linux:9: tar

The GNU tar program can save multiple files in an archive and restore files from an archive.

Security Fix(es):

* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)

* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)

* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)

Bug Fix(es) and Enhancement(s):

* tar: --one-top-level with absolute path fails [rhel-9] (JIRA:Rocky Linux-144021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-18477

Affected: Ubuntu:Pro:14.04:LTS: tar, Ubuntu:Pro:16.04:LTS: tar, Ubuntu:Pro:18.04:LTS: tar, Ubuntu:Pro:20.04:LTS: tar, Ubuntu:22.04:LTS: tar, Ubuntu:24.04:LTS: tar, Ubuntu:26.04:LTS: tar

WID-SEC-W-2026-2633 — GNU tar: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Ein Angreifer kann mehrere Schwachstellen in GNU tar ausnutzen, um Dateien zu manipulieren.