Lucene search

K
mageiaGentoo FoundationMGASA-2023-0079
HistoryMar 02, 2023 - 12:14 a.m.

Updated tar packages fix security vulnerability

2023-03-0200:14:31
Gentoo Foundation
advisories.mageia.org
25
gnu tar
1.34
out-of-bounds read
uninitialized memory
conditional jump
list.c
v7 archive
mtime
whitespace characters
cve-2022-48303
unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.0005 Low

EPSS

Percentile

18.9%

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. (CVE-2022-48303)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchtar< 1.33-2.2tar-1.33-2.2.mga8

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.0005 Low

EPSS

Percentile

18.9%