#4813: tar-1.34
--------------------+-----------------------
Reporter: bdubbs | Owner: lfs-book
Type: task | Status: closed
Priority: high | Milestone: 10.1
Component: Book | Version: SVN
Severity: normal | Resolution: fixed
Keywords: |
--------------------+-----------------------
Changes (by renodr):
* priority: normal => high
Comment:
Retroactively promote due to CVE-2021-20193
{{{
Arch Linux Security Advisory ASA-202102-41
==========================================
Severity: Low
Date : 2021-02-27
CVE-ID : CVE-2021-20193
Package : tar
Type : denial of service
Remote : No
Link : https://security.archlinux.org/AVG-1462
Summary
=======
The package tar before version 1.34-1 is vulnerable to denial of
service.
Resolution
==========
Upgrade to 1.34-1.
# pacman -Syu "tar>=1.34-1"
The problem has been fixed upstream in version 1.34.
Workaround
==========
None.
Description
===========
An issue was discovered in GNU Tar before version 1.34. There is a
memory leak in read_header() in list.c in the tar application.
Impact
======
A crafted tar archive can crash the application.
References
==========
https://bugzilla.redhat.com/show_bug.cgi?id=1917565
https://savannah.gnu.org/bugs/?59897
https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777
https://security.archlinux.org/CVE-2021-20193
}}}
--
Ticket URL: <http://wiki.linuxfromscratch.org/lfs/ticket/4813#comment:3>
LFS Trac <http://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.
--
http://lists.linuxfromscratch.org/listinfo/lfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page
