{"id":"CVE-2022-48303","aliases":["ALPINE-CVE-2022-48303","ALSA-2023:0842","ALSA-2023:0959","AZL-37145","BELL-CVE-2022-48303","CLSA-2023-1677783720","CLSA-2023-1677783889","CLSA-2023-1677783967","CLSA-2023-1677784249","CLSA-2023-1677791921","DEBIAN-CVE-2022-48303","EUVD-2022-51003","GHSA-h2v4-4v4p-2qvc","JLSEC-2026-184","MGASA-2023-0079","OESA-2023-1089","OESA-2023-1103","OESA-2023-1104","OESA-2023-1106","RHSA-2023:0842","RHSA-2023:0959","RHSA-2023:5610","RLSA-2023:0842","RLSA-2023:0959","SUSE-SU-2023:0441-1","SUSE-SU-2023:0463-1","UBUNTU-CVE-2022-48303","USN-5900-1","openSUSE-SU-2024:12744-1"],"status":"published","title":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized...","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01536,"percentile":0.75062,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-01-30T00:00:00Z","modified":"2026-11-03T07:18:33Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"tar","fixed_in":["1.34-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"tar","fixed_in":["1.34-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"tar","fixed_in":["1.34-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tar","fixed_in":["1.34-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tar","fixed_in":["2:1.30-6.el8_7.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tar","fixed_in":["2:1.34-6.el9_1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"tar","fixed_in":["1.34-3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"tar","fixed_in":["2:1.30-5.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"tar","fixed_in":["2:1.30-5.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tar","fixed_in":["2:1.23-15.el6_8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tar","fixed_in":["2:1.23-15.el6_8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tar","fixed_in":["1.34+dfsg-1.2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tar","fixed_in":["1.34+dfsg-1.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tar","fixed_in":["1.34+dfsg-1.4"],"sources":["osv"]},{"ecosystem":"Julia","package":"Tar_jll","fixed_in":["1.35.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"tar","fixed_in":["1.33-2.2.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"tar","fixed_in":["1.32-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"tar","fixed_in":["1.32-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"tar","fixed_in":["1.34-4.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"tar","fixed_in":["1.34-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar","fixed_in":["2:1.30-6.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debuginfo","fixed_in":["2:1.30-6.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debugsource","fixed_in":["2:1.30-6.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar","fixed_in":["2:1.34-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debuginfo","fixed_in":["2:1.34-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debugsource","fixed_in":["2:1.34-6.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"tar","fixed_in":["2:1.30-5.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"tar-debuginfo","fixed_in":["2:1.30-5.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"tar-debugsource","fixed_in":["2:1.30-5.el8_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"tar","fixed_in":["2:1.30-6.el8_7.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"tar","fixed_in":["2:1.34-6.el9_1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tar","fixed_in":["1.27.1-15.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tar","fixed_in":["1.27.1-15.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"tar","fixed_in":["1.34-150000.3.31.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","fixed_in":["1.27.1-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","fixed_in":["1.28-2.1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"tar","fixed_in":["1.29b-2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tar","fixed_in":["1.30+dfsg-7ubuntu0.20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tar","fixed_in":["1.34+dfsg-1ubuntu0.1.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tar","fixed_in":["1.34-10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-6.el8_7.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-6.el9_1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-5.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-5.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.23-15.el6_8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tar-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.23-15.el6_8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.2+deb12u1"}]}],"versions":["1.34+dfsg-1.2"]},{"source":"osv","ecosystem":"Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.4"}]}]},{"source":"osv","ecosystem":"Julia","package":"Tar_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33-2.2.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-4.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-6.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-6.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-6.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-6.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-5.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"tar-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-5.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"tar-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-5.el8_6.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-6.el8_7.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-6.el9_1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-15.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-15.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.31.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm3"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm2"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.3"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.1"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm3"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm2"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.3"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.1"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-10.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"tar"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://savannah.gnu.org/bugs/?62387","tags":["x_transferred","Exploit","Vendor Advisory","evidence","web","article","report"]},{"url":"https://savannah.gnu.org/patch/?10307","tags":["x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-806742.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48303","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4"},{"url":"https://github.com/advisories/GHSA-h2v4-4v4p-2qvc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-48303","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0842","tags":["advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-48303","tags":["report"]},{"url":"https://bugzilla.redhat.com/2149722","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0842.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0959","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-0959.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-48303","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1677783720.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1677783889.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2023-1677783967.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1677784249","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2023-1677791921.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-48303","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0079.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31569","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-February/013834.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EMCL5SDDZC2JTGVOT5D2T56IWCRICHJD/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1089","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1103","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1104","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1106","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2149722","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0842.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48303","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0959.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5610","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5610.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0842","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0959","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230441-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207753","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48303","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230463-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202436","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48303","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5900-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5900-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-48303","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T00:00:00Z","modified":"2026-10-14T18:44:26.43Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-51003","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T00:00:00Z","modified":"2026-10-14T18:44:26Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:13.272666Z"}],"ghsa":[{"id":"GHSA-h2v4-4v4p-2qvc","title":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized...","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T06:30:27Z","modified":"2026-10-14T21:31:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:13:28.606179Z"}],"nvd":[{"id":"CVE-2022-48303","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T04:15:08.03Z","modified":"2026-10-14T19:16:56.197Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:35.561816Z"}],"osv":[{"id":"ALPINE-CVE-2022-48303","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T04:15:08.03Z","modified":"2026-11-03T07:18:33.787938018Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-37145","title":"CVE-2022-48303 affecting package tar for versions less than 1.34-3","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T04:15:08Z","modified":"2026-04-21T04:28:13.514335Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BELL-CVE-2022-48303","title":"CVE-2022-48303 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:38.275565Z","modified":"2026-01-26T09:46:21.139121Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-48303","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T04:15:08.03Z","modified":"2026-04-16T04:38:24.05655613Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"JLSEC-2026-184","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in `from_header` in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2026-04-24T13:16:18.171Z","modified":"2026-07-25T18:24:03.57860642Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2023-1089","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.(CVE-2022-48303)","status":"published","published":"2023-02-17T11:05:34Z","modified":"2026-08-18T01:17:30.725318458Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1103","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.(CVE-2022-48303)","status":"published","published":"2023-02-17T11:05:34Z","modified":"2026-08-18T01:16:56.935547131Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1104","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.(CVE-2022-48303)","status":"published","published":"2023-02-17T11:05:34Z","modified":"2026-08-18T01:16:57.090093796Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1106","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nGNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.(CVE-2022-48303)","status":"published","published":"2023-02-21T11:05:35Z","modified":"2026-08-18T01:17:31.788025246Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:0842","title":"Red Hat Security Advisory: tar security update","status":"published","published":"2024-09-16T10:45:19Z","modified":"2025-11-22T12:46:04Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0959","title":"Red Hat Security Advisory: tar security update","status":"published","published":"2024-09-16T10:45:27Z","modified":"2025-11-22T12:46:18Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:5610","title":"Red Hat Security Advisory: tar security update","status":"published","published":"2024-09-16T10:45:36Z","modified":"2025-11-22T12:56:56Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RLSA-2023:0842","title":"Moderate: tar security update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: heap buffer overflow at from_header() in list.c via specially crafted checksum (CVE-2022-48303)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-02-22T01:08:44.136543Z","modified":"2026-02-04T14:15:12.154817Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:0959","title":"Moderate: tar security update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: heap buffer overflow at from_header() in list.c via specially crafted checksum (CVE-2022-48303)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-06T15:53:31.763565Z","modified":"2026-02-04T13:30:09.022223Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-48303","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T04:15:00Z","modified":"2026-02-04T03:50:09.385451Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2023:0842","title":"Moderate: tar security update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: heap buffer overflow at from_header() in list.c via specially crafted checksum (CVE-2022-48303)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-02-21T00:00:00Z","modified":"2026-10-29T11:01:34.583307682Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0959","title":"Moderate: tar security update","description":"The GNU tar program can save multiple files in an archive and restore files from an archive.\n\nSecurity Fix(es):\n\n* tar: heap buffer overflow at from_header() in list.c via specially crafted checksum (CVE-2022-48303)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-02-28T00:00:00Z","modified":"2026-10-29T11:31:24.291779118Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2023-1677783720","title":"tar: Fix of CVE-2022-48303","description":"- CVE-2022-48303: check for the end of field after leading byte (0x80 or 0xff)\n  of base-256 encoded header value.","status":"published","published":"2023-03-02T19:02:00Z","modified":"2026-06-01T00:33:11.278991404Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1677783889","title":"tar: Fix of CVE-2022-48303","description":"- CVE-2022-48303: check for the end of field after leading byte (0x80 or 0xff)\n  of base-256 encoded header value.","status":"published","published":"2023-03-02T19:04:49Z","modified":"2026-06-01T00:33:21.825158309Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1677783967","title":"tar: Fix of CVE-2022-48303","description":"- CVE-2022-48303: check for the end of field after leading byte (0x80 or 0xff)\n  of base-256 encoded header value","status":"published","published":"2023-03-02T19:06:07Z","modified":"2026-06-01T00:33:24.767901774Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1677784249","title":"Fix CVE(s): CVE-2022-48303, CVE-2021-20193","description":"\n   * SECURITY UPDATE: memory leak in read_header\n     - debian/patches/CVE-2021-20193.patch: Don't return directly\n       from the loop. Instead set the status and break.  Return the\n       status.\n     - CVE-2021-20193.patch\n   * SECURITY UPDATE: a heap buffer overflow\n     - debian/patches/CVE-2022-48303.patch: Check for the end of\n       field after leading byte (0x80 or 0xff) of base-256 encoded\n       header value.\n     - CVE-2022-48303.patch\n   * improve debian/rules to build the project by root","status":"published","published":"2023-03-02T19:10:49Z","modified":"2026-06-04T10:04:07.028543295Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1677791921","title":"tar: Fix of CVE-2022-48303","description":"- CVE-2022-48303: check for the end of field after leading byte (0x80 or 0xff)\n  of base-256 encoded header value","status":"published","published":"2023-03-02T21:18:41Z","modified":"2026-06-01T00:33:15.814832438Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"DEBIAN-CVE-2022-48303","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.","status":"published","published":"2023-01-30T04:15:08.03Z","modified":"2026-11-03T06:03:12.447037887Z","updated_at":"2026-11-03T06:42:33.899035Z"},{"id":"MGASA-2023-0079","title":"Updated tar packages fix security vulnerability","description":"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use\nof uninitialized memory for a conditional jump. Exploitation to change the\nflow of control has not been demonstrated. The issue occurs in from_header\nin list.c via a V7 archive in which mtime has approximately 11 whitespace\ncharacters. (CVE-2022-48303)\n","status":"published","published":"2023-03-01T21:14:31Z","modified":"2026-04-16T04:40:35.583648449Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12744-1","title":"tar-1.34-10.1 on GA media","description":"These are all security issues fixed in the tar-1.34-10.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:14:31.400892Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0441-1","title":"Security update for tar","description":"This update for tar fixes the following issues:\n\n- CVE-2022-48303: Fixed a one-byte out-of-bounds read that resulted in use of uninitialized memory for a conditional jump (bsc#1207753).\n","status":"published","published":"2023-02-17T08:41:09Z","modified":"2026-02-04T02:47:15.568402Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0463-1","title":"Security update for tar","description":"This update for tar fixes the following issues:\n\n- CVE-2022-48303: Fixed a one-byte out-of-bounds read that resulted in use of uninitialized memory for a conditional jump (bsc#1207753). \n\nBug fixes:\n\n- Fix hang when unpacking test tarball (bsc#1202436).\n","status":"published","published":"2023-02-20T15:33:55Z","modified":"2026-02-04T04:03:37.781272Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5900-1","title":"tar vulnerability","description":"It was discovered that tar incorrectly handled certain files.\nAn attacker could possibly use this issue to expose sensitive information\nor cause a crash.\n","status":"published","published":"2023-02-28T17:15:54Z","modified":"2026-06-29T13:50:47.593745582Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}