Every CVE Search/ Get API key

CVE-2021-33640

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is...

6.2 MediumFix available

CVE-2021-33640 is a medium vulnerability (CVSS 6.2) in Fedoraproject Fedora, published December 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in libtar 1.2.20-11.

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.69%Down 0.2 points since Dec 20, 2022
90%50%10%1%

What each source reports

CVE List Score used 6.2

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Record
CVE-2021-33640
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2021-20317 6.2

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Record
EUVD-2021-20317
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-pjrv-5vw3-5frj 9.8

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is...

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Record
GHSA-pjrv-5vw3-5frj
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 6.2

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Record
CVE-2021-33640
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVAZL-12933 9.8

CVE-2021-33640 affecting package libtar for versions less than 1.2.20-11

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Record
AZL-12933
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-34950 9.8

CVE-2021-33640 affecting package libtar for versions less than 1.2.20-11

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).

Record
AZL-34950
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVOESA-2022-2129 6.2

libtar security update

Libtar is a C library for manipulating POSIX tar files. It handles adding and extracting files to/from a tar archive. Requires gcc, make, and zlib.

Security Fix(es):

No description is available for this CVE.(CVE-2021-33640)

Record
OESA-2022-2129
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1008 6.2

libtar security update

Libtar is a C library for manipulating POSIX tar files. It handles adding and extracting files to/from a tar archive. Requires gcc, make, and zlib.

Security Fix(es):

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).(CVE-2021-33640)

Record
OESA-2023-1008
CVSS 3.1
6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2022-0488 No score

Updated libtar packages fix security vulnerability

After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free). (CVE-2021-33640)

Record
MGASA-2022-0488
Updated
2026-11-02
OSVopenSUSE-SU-2026:11092-1 No score

libtar-1.2.20-3.1 on GA media

These are all security issues fixed in the libtar-1.2.20-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11092-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtar
Azure Linux:2
 before 1.2.20-11
1.2.20-11
libtar
Azure Linux:3
 before 1.2.20-11
1.2.20-11
libtar
Mageia:8
 before 1.2.20-9.2.mga8
1.2.20-9.2.mga8
libtar
openEuler:20.03-LTS-SP1
 before 1.2.20-20.oe1
1.2.20-20.oe1
libtar
openEuler:20.03-LTS-SP3
 before 1.2.20-20.oe1
1.2.20-20.oe1
libtar
openEuler:22.03-LTS
 before 1.2.20-22.oe2203
1.2.20-22.oe2203
libtar
openEuler:22.03-LTS-SP1
 before 1.2.20-22.oe2203sp1
1.2.20-22.oe2203sp1
libtar
openSUSE:Tumbleweed
 before 1.2.20-3.1
1.2.20-3.1

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open