CVE-2022-48303Medium· 5.5▾ SunlitGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c vi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.5%
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
tar <= 1.34fedora = 37fedora = 38Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2019-25013Medium· 5.9The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.
CVE-2021-20193Low· 3.3A flaw was found in the src/list.c of tar 1.33 and earlier
CVE-2019-3859Critical· 9.1An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions
CVE-2023-0361High· 7.4A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS
CVE-2021-3998High· 7.5A flaw was found in glibc
CVE-2019-1010180High· 7.8GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access