{"id":"CVE-2021-33643","aliases":["ALSA-2023:2898","AZL-10542","AZL-34946","DEBIAN-CVE-2021-33643","DLA-4033-1","EUVD-2021-20320","GHSA-j7g9-fcw9-wxcf","MGASA-2022-0335","OESA-2022-1807","RHSA-2023:2898","RLSA-2023:2898","UBUNTU-CVE-2021-33643","USN-7398-1","openSUSE-SU-2026:11092-1"],"status":"published","title":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to...","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01876,"percentile":0.79561,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-08-05T11:05:04Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"libtar","fixed_in":["1.2.20-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libtar","fixed_in":["1.2.20-11"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libtar","fixed_in":["1.2.20-8+deb12u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libtar","fixed_in":["1.2.20-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libtar","fixed_in":["1.2.20-7ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libtar","fixed_in":["1.2.20-8ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libtar","fixed_in":["1.2.20-8ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libtar","fixed_in":["1.2.20-8.1ubuntu0.24.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-17.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8+deb12u1"}]}],"versions":["1.2.20-8","1.2.20-8+deb12u1~deb11u1"]},{"source":"osv","ecosystem":"Debian:11","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8+deb12u1~deb11u1"}]}],"versions":["1.2.20-8"],"bundled":4},{"source":"osv","ecosystem":"Mageia:8","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-9.1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-19.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-19.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-21.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-17.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-17.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libtar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-17.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.20-17.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-4ubuntu0.1~esm1"}]}],"versions":["1.2.20-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-7ubuntu0.1~esm1"}]}],"versions":["1.2.20-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8ubuntu0.20.04.1"}]}],"versions":["1.2.20-7","1.2.20-8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8ubuntu0.22.04.1"}]}],"versions":["1.2.20-8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8.1ubuntu0.24.04.1"}]}],"versions":["1.2.20-8","1.2.20-8.1","1.2.20-8.1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-4ubuntu0.1~esm1"}]}],"versions":["1.2.20-4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-7ubuntu0.1~esm1"}]}],"versions":["1.2.20-7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8ubuntu0.20.04.1"}]}],"versions":["1.2.20-7","1.2.20-8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8ubuntu0.22.04.1"}]}],"versions":["1.2.20-8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-8.1ubuntu0.24.04.1"}]}],"versions":["1.2.20-8","1.2.20-8.1","1.2.20-8.1build1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libtar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.20-3.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"feep","product":"libtar"},{"vendor":"openatom","product":"openeuler"}],"references":[{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807","tags":["x_transferred","Broken Link","Third Party Advisory","advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00026.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33643","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC"},{"url":"https://github.com/advisories/GHSA-j7g9-fcw9-wxcf"},{"url":"https://access.redhat.com/errata/RHSA-2023:2898","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33643","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33644","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33645","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33646","tags":["report"]},{"url":"https://bugzilla.redhat.com/2121289","tags":["report"]},{"url":"https://bugzilla.redhat.com/2121292","tags":["report"]},{"url":"https://bugzilla.redhat.com/2121295","tags":["report"]},{"url":"https://bugzilla.redhat.com/2121297","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2898.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33643","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0335.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30821","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33645","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33646","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121297","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2898.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33643","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33644","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33645","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33646","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2898","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33643","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7398-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33646","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33645","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-33643","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-09T00:00:00Z","modified":"2026-06-23T14:42:04.986Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-20320","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-09T00:00:00Z","modified":"2026-06-23T14:42:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:33.324654Z"}],"ghsa":[{"id":"GHSA-j7g9-fcw9-wxcf","title":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to...","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-11T00:00:15Z","modified":"2025-11-03T21:31:46Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:04:19.274788Z"}],"nvd":[{"id":"CVE-2021-33643","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-10T20:15:20.45Z","modified":"2026-06-23T16:16:57.427Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"AZL-10542","title":"CVE-2021-33643 affecting package libtar for versions less than 1.2.20-10","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-10T20:15:20Z","modified":"2026-04-21T04:21:05.939367Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-34946","title":"CVE-2021-33643 affecting package libtar for versions less than 1.2.20-11","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-10T20:15:20Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"CVE-2021-33643","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-10T20:15:20.45Z","modified":"2026-06-24T09:14:31.510019029Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-33643","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-10T20:15:20.45Z","modified":"2026-10-23T18:04:49.793166897Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2022-1807","title":"libtar security update","description":"Libtar is a C library for manipulating POSIX tar files. It handles adding and extracting files to/from a tar archive. Requires gcc, make, and zlib.\r\n\r\nSecurity Fix(es):\r\n\r\nAn attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.(CVE-2021-33643)\r\n\r\nAn attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.(CVE-2021-33644)\r\n\r\nThe th_read() function doesn’t free a variable t-\u0026gt;th_buf.gnu_longlink after allocating memory, which may cause a memory leak.(CVE-2021-33645)\r\n\r\nThe th_read() function doesn’t free a variable t-\u0026gt;th_buf.gnu_longname after allocating memory, which may cause a memory leak.(CVE-2021-33646)","status":"published","published":"2022-08-05T11:05:04Z","modified":"2026-08-18T01:16:52.961380939Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2023:2898","title":"Red Hat Security Advisory: libtar security update","status":"published","published":"2024-09-16T10:39:30Z","modified":"2026-06-26T11:04:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:2898","title":"Moderate: libtar security update","description":"The libtar packages contain a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions.\n\nSecurity Fix(es):\n\n* libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)\n\n* libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)\n\n* libtar: memory leak found in th_read() function (CVE-2021-33645)\n\n* libtar: memory leak found in th_read() function (CVE-2021-33646)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2025-12-27T09:04:03.511459Z","modified":"2025-12-27T09:29:56.479725Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2021-33643","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","status":"published","published":"2022-08-10T20:15:00Z","modified":"2026-06-25T08:45:11.738022658Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2023:2898","title":"Moderate: libtar security update","description":"The libtar packages contain a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions.\n\nSecurity Fix(es):\n\n* libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)\n* libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)\n* libtar: memory leak found in th_read() function (CVE-2021-33645)\n* libtar: memory leak found in th_read() function (CVE-2021-33646)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:06.298990354Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"DLA-4033-1","title":"libtar - security update","status":"published","published":"2025-01-28T00:00:00Z","modified":"2026-03-09T01:23:23.248452Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2022-0335","title":"Updated libtar packages fix security vulnerability","description":"An attacker who submits a crafted tar file with size in header struct\nbeing 0 may be able to trigger an calling of malloc(0) for a variable\ngnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)\n\nAn attacker who submits a crafted tar file with size in header struct\nbeing 0 may be able to trigger an calling of malloc(0) for a variable\ngnu_longname, causing an out-of-bounds read. (CVE-2021-33644)\n\nThe th_read() function doesn't free a variable t-\u003eth_buf.gnu_longlink\nafter allocating memory, which may cause a memory leak. (CVE-2021-33645)\n\nThe th_read() function doesn't free a variable t-\u003eth_buf.gnu_longname\nafter allocating memory, which may cause a memory leak. (CVE-2021-33646)\n","status":"published","published":"2022-09-16T19:39:55Z","modified":"2026-04-16T04:40:46.450373399Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2026:11092-1","title":"libtar-1.2.20-3.1 on GA media","description":"These are all security issues fixed in the libtar-1.2.20-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:22.381444573Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"USN-7398-1","title":"libtar vulnerabilities","description":"It was discovered that libtar may perform out-of-bounds reads when\nprocessing specially crafted tar files. An attacker could possibly use\nthis issue to cause libtar to crash, resulting in a denial of service,\nor execute arbitrary code. (CVE-2021-33643, CVE-2021-33644)\n\nIt was discovered that libtar contained a memory leak due to failing\nto free a variable, causing performance degradation. An attacker\ncould possibly use this issue to cause libtar to crash, resulting in a\ndenial of service. (CVE-2021-33645, CVE-2021-33646)\n","status":"published","published":"2025-03-31T15:25:54Z","modified":"2026-06-25T13:32:30.321329245Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}