CVE-2019-9923

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

USN-4692-1 — tar vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: tar, Ubuntu:16.04:LTS: tar, Ubuntu:18.04:LTS: tar, Ubuntu:20.04:LTS: tar

Chris Siebenmann discovered that tar incorrectly handled extracting files resized during extraction when invoked with the --sparse flag. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20482)

Daniel Axtens discovered that tar incorrectly handled certain malformed tar files. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to cause tar to crash, resulting in a denial of service. (CVE-2019-9923)

Most recent entries from all

CVE-2019-9923

USN-4692-1 — tar vulnerabilities