CVE-2022-48303

CWE-125 — Out-of-bounds ReadCWE-119 — Buffer Overflow9 documents8 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 85.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GNU TARFedoraproject Fedora
Timeline
PublishedJan 30
Latest updateMay 22

Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶Debiantar< 1.34+dfsg-1+deb11u1+3
▶NVDgnu/tar1.34

Also affects: Fedora 37, 38

Patches

Patch: savannah.gnu.org ↗Patch: savannah.gnu.org ↗

🔴Vulnerability Details

3
OSV
CVE-2022-48303: GNU Tar through 1↗2023-01-30
▶
GHSA
GHSA-h2v4-4v4p-2qvc: GNU Tar through 1↗2023-01-30
▶
CVEList
CVE-2022-48303: GNU Tar through 1↗2023-01-30
▶

📋Vendor Advisories

5
Ubuntu
tar vulnerability↗2023-05-22
▶
Ubuntu
tar vulnerability↗2023-02-28
▶
Microsoft
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump↗2023-01-10
▶
Red Hat
tar: heap buffer overflow at from_header() in list.c via specially crafted checksum↗2022-04-30
▶
Debian
CVE-2022-48303: tar - GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of un...↗2022
▶