Feep Libtar vulnerabilities
6 known vulnerabilities affecting feep/libtar.
Total CVEs
6
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH3MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2021-33643CRITICALCVSS 9.1fixed in 1.2.21v<1.2.212022-08-10
CVE-2021-33643 [CRITICAL] CWE-125 CVE-2021-33643: An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.
nvdosv
CVE-2021-33646HIGHCVSS 7.5fixed in 1.2.21v<1.2.212022-08-10
CVE-2021-33646 [HIGH] CWE-401 CVE-2021-33646: The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which
The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.
nvdosv
CVE-2021-33645HIGHCVSS 7.5fixed in 1.2.21v<1.2.212022-08-10
CVE-2021-33645 [HIGH] CWE-401 CVE-2021-33645: The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.
nvdosv
CVE-2021-33644HIGHCVSS 8.1fixed in 1.2.21v<1.2.212022-08-10
CVE-2021-33644 [HIGH] CWE-125 CVE-2021-33644: An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
nvdosv
CVE-2013-4420MEDIUMCVSS 5.8≤ 1.2.20v1.2.11+7 more2014-02-20
CVE-2013-4420 [MEDIUM] CWE-22 CVE-2013-4420: Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all fun
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
nvdosv
CVE-2013-4397MEDIUMCVSS 6.8≤ 1.2.19v1.2.11+6 more2013-10-17
CVE-2013-4397 [MEDIUM] CWE-189 CVE-2013-4397: Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remo
Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.
nvdosv