---
id: CVE-2018-20482
title: >-
  GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during
  read access, which allows local users to cause a denial of service (infinite
  read loop in sparse_dump_region in sparse.c) by modifying a file that is
  supposed …
summary: >-
  GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during
  read access, which allows local users to cause a denial of service (infinite
  read loop in sparse_dump_region in sparse.c) by modifying a file that is
  supposed …
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
vendor: gnu
product: tar
affected:
  - tar <= 1.30
  - debian_linux = 8.0
  - debian_linux = 9.0
  - leap = 15.0
published: '2018-12-26'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:43.667'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-20482'
references:
  - url: >-
      http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454
    label: cve@mitre.org
  - url: 'http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html'
    label: cve@mitre.org
  - url: 'http://www.securityfocus.com/bid/106354'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2018/12/msg00023.html'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2021/11/msg00025.html'
    label: cve@mitre.org
  - url: 'https://news.ycombinator.com/item?id=18745431'
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/201903-05'
    label: cve@mitre.org
  - url: 'https://twitter.com/thatcks/status/1076166645708668928'
    label: cve@mitre.org
  - url: 'https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug'
    label: cve@mitre.org
  - url: >-
      http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/106354'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2018/12/msg00023.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2021/11/msg00025.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://news.ycombinator.com/item?id=18745431'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/201903-05'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://twitter.com/thatcks/status/1076166645708668928'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-20482.json
  - url: 'https://access.redhat.com/security/cve/CVE-2018-20482'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1662346'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2018-20482'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-20482'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.0053
epssPercentile: 0.4329
ingestedAt: '2026-10-14T07:21:04.803Z'
scores:
  nvd: 4.7
  vendor: 5.5
---

## Overview

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

## Affected

- `tar <= 1.30`
- `debian_linux = 8.0`
- `debian_linux = 9.0`
- `leap = 15.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-20482.json)