CVE-2023-39804
Fixed in a distro release EPSS <1%CVSS 6.2
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.
Products: gnu tar
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | tar | 2:1.26-35.amzn2.0.3 |
| Amazon Linux 2023 | tar | 2:1.34-1.amzn2023.0.4 |
| Debian 10 | tar | 1.30+dfsg-6+deb10u1 |
| Debian 12 | tar | 1.34+dfsg-1.2+deb12u1 |
| Debian 13 | tar | 1.34+dfsg-1.3 |
| Debian 14 | tar | 1.34+dfsg-1.3 |
| SUSE Linux Enterprise Micro 5.1 | tar | 1.34-150000.3.34.1 |
| SUSE Linux Enterprise Micro 5.2 | tar | 1.34-150000.3.34.1 |
| SUSE Linux Enterprise Micro 5.3 | tar | 1.34-150000.3.34.1 |
| SUSE Linux Enterprise Micro 5.4 | tar | 1.34-150000.3.34.1 |
| SUSE Linux Enterprise Micro 5.5 | tar | 1.34-150000.3.34.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | tar | 1.34-150000.3.34.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | tar | 1.34-150000.3.34.1 |
| SUSE Linux Enterprise Server 12 SP5 | tar | 1.27.1-15.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | tar | 1.27.1-15.24.1 |
| Ubuntu 20.04 LTS | tar | 1.30+dfsg-7ubuntu0.20.04.4 |
| Ubuntu 22.04 LTS | tar | 1.34+dfsg-1ubuntu0.1.22.04.2 |
| Ubuntu Pro 14.04 LTS | tar | 1.27.1-1ubuntu0.1+esm4 |
| Ubuntu Pro 16.04 LTS | tar | 1.28-2.1ubuntu0.2+esm3 |
| Ubuntu Pro 18.04 LTS | tar | 1.29b-2ubuntu0.4+esm1 |
| openSUSE Leap 15.4 | tar | 1.34-150000.3.34.1 |
| openSUSE Leap 15.5 | tar | 1.34-150000.3.34.1 |
| openSUSE Leap Micro 5.3 | tar | 1.34-150000.3.34.1 |
| openSUSE Leap Micro 5.4 | tar | 1.34-150000.3.34.1 |
| openSUSE Tumbleweed | tar | 1.35-2.1 |