An update of the libtar package has been released.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ccc68b06cc advisory.

    - fix use-after-free bugs introduced by incorrect memleak fixes (CVE-2021-33640)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:2898 advisory.

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0067 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-33643:
    An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.

    CVE-2021-33644:
    An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

    CVE-2021-33645:
    The th_read() function doesnt free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak.

    CVE-2021-33646:
    The th_read() function doesnt free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-88772d0a2d advisory.

    - fix use-after-free bugs introduced by incorrect memleak fixes (CVE-2021-33640)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
332324	Photon OS 5.0: Libtar PHSA-2023-5.0-91-0010	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	critical
169344	Fedora 36 : libtar (2022-ccc68b06cc)	Nessus	Fedora Local Security Checks	2022/12/28	2024/11/14	critical
176159	AlmaLinux 8 : libtar (ALSA-2023:2898)	Nessus	Alma Linux Local Security Checks	2023/5/20	2023/5/20	critical
236098	Alibaba Cloud Linux 3 : 0067: libtar (ALINUX3-SA-2023:0067)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
332509	Photon OS 5.0: Libtar PHSA-2023-5.0-90-0010	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	critical
211208	Fedora 37 : libtar (2022-88772d0a2d)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical