{"id":"CVE-2023-39804","aliases":["AZL-52625","BELL-CVE-2023-39804","CLSA-2024-1706026767","CLSA-2024-1710436683","CLSA-2025-1762535960","CLSA-2025-1762536241","CLSA-2026-1778820779","CLSA-2026-1778828497","DEBIAN-CVE-2023-39804","DLA-3755-1","EUVD-2023-43504","GHSA-5pvw-wf9w-xx8v","JLSEC-2026-185","OESA-2023-1991","OESA-2023-1992","OESA-2023-1993","OESA-2023-1994","OESA-2023-2002","SUSE-SU-2024:0070-1","SUSE-SU-2024:0070-2","SUSE-SU-2024:0071-1","UBUNTU-CVE-2023-39804","USN-6543-1","openSUSE-SU-2024:13751-1"],"status":"published","title":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an...","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00283,"percentile":0.20923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-11-30T00:00:00Z","modified":"2026-11-09T02:45:24Z","fixes":[{"ecosystem":"Azure Linux:2","package":"tar","fixed_in":["1.34-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"tar","fixed_in":["1.34-r3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"tar","fixed_in":["1.28-2.1ubuntu0.2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"tar-scripts","fixed_in":["1.28-2.1ubuntu0.2+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tar","fixed_in":["1.29b-2ubuntu0.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tar-scripts","fixed_in":["1.29b-2ubuntu0.4+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"tar","fixed_in":["2:1.30-5.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"tar","fixed_in":["2:1.30-5.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","fixed_in":["2:1.34-7.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tar","fixed_in":["1.34+dfsg-1.2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tar","fixed_in":["1.34+dfsg-1.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tar","fixed_in":["1.34+dfsg-1.3"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"tar","fixed_in":["1.30+dfsg-6+deb10u1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Tar_jll","fixed_in":["1.35.0+0"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"tar","fixed_in":["1.34-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"tar","fixed_in":["1.34-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"tar","fixed_in":["1.34-5.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"tar","fixed_in":["1.32-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"tar","fixed_in":["1.32-4.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tar","fixed_in":["1.34-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tar","fixed_in":["1.27.1-15.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tar","fixed_in":["1.27.1-15.24.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","fixed_in":["1.27.1-1ubuntu0.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","fixed_in":["1.28-2.1ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","fixed_in":["1.29b-2ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tar","fixed_in":["1.30+dfsg-7ubuntu0.20.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tar","fixed_in":["1.34+dfsg-1ubuntu0.1.22.04.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tar","fixed_in":["1.35-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.34-r1"},{"fixed":"1.34-r3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tar-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tar-scripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-5.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.30-5.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.34-7.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.2+deb12u1"}]}],"versions":["1.34+dfsg-1.2"]},{"source":"osv","ecosystem":"Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1.3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-6+deb10u1"}]}],"versions":["1.30+dfsg-6"]},{"source":"osv","ecosystem":"Julia","package":"Tar_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-5.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32-4.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-15.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-15.24.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm4"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm3"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+esm1"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.4"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.2"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1+esm4"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1","1.27.1-1ubuntu0.1","1.27.1-1ubuntu0.1+esm1","1.27.1-1ubuntu0.1+esm2","1.27.1-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.2+esm3"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1","1.28-2.1ubuntu0.1","1.28-2.1ubuntu0.2","1.28-2.1ubuntu0.2+esm1","1.28-2.1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-2ubuntu0.4+esm1"}]}],"versions":["1.29b-2","1.29b-2ubuntu0.1","1.29b-2ubuntu0.2","1.29b-2ubuntu0.3","1.29b-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30+dfsg-7ubuntu0.20.04.4"}]}],"versions":["1.30+dfsg-6","1.30+dfsg-7","1.30+dfsg-7ubuntu0.20.04.1","1.30+dfsg-7ubuntu0.20.04.2","1.30+dfsg-7ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34+dfsg-1ubuntu0.1.22.04.2"}]}],"versions":["1.34+dfsg-1build1","1.34+dfsg-1build2","1.34+dfsg-1build3","1.34+dfsg-1ubuntu0.1.22.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-2.1"}]}]}],"products":[{"vendor":"gnu","product":"tar"}],"references":[{"url":"https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723","tags":["x_transferred","Product","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39804","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5pvw-wf9w-xx8v"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-39804","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1706026767.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1710436683.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2025-1762535960.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2025-1762536241.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778820779.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778828497.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39804.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-39804","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1991","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1992","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1993","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1994","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-2002","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240070-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217969","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39804","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240070-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240071-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-39804","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6543-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39804","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:16:37.208Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:35:33.462059Z"}],"euvd":[{"id":"EUVD-2023-43504","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:16:37Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-5pvw-wf9w-xx8v","title":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an...","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2024-03-27T06:30:30Z","modified":"2025-11-04T21:31:22Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:04:36.536202Z"}],"nvd":[{"id":"CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2024-03-27T04:15:08.897Z","modified":"2026-06-17T06:12:52.757Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:09:10.192572Z"}],"osv":[{"id":"BELL-CVE-2023-39804","status":"published","published":"2023-12-01T05:59:32.537005Z","modified":"2026-01-26T09:33:33.612866Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2024-03-27T00:00:00Z","modified":"2026-11-09T02:45:24.204952628Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2024-03-27T04:15:08.897Z","modified":"2026-10-26T18:02:31.972569504Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"JLSEC-2026-185","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2026-04-24T13:16:18.171Z","modified":"2026-07-18T00:00:28.070347414Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2023-1991","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service.(CVE-2023-39804)","status":"published","published":"2023-12-29T11:06:26Z","modified":"2026-08-18T01:18:07.765411483Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1992","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service.(CVE-2023-39804)","status":"published","published":"2023-12-29T11:06:26Z","modified":"2026-08-18T01:18:07.789198644Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1993","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service.(CVE-2023-39804)","status":"published","published":"2023-12-29T11:06:26Z","modified":"2026-08-18T01:18:07.152618212Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1994","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service.(CVE-2023-39804)","status":"published","published":"2023-12-29T11:06:26Z","modified":"2026-08-18T01:18:07.321218384Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-2002","title":"tar security update","description":"GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in tar. This issue occurs when extended attributes are processed in PAX archives, and could allow an attacker to cause an application crash, resulting in a denial of service.(CVE-2023-39804)","status":"published","published":"2023-12-29T11:06:26Z","modified":"2026-08-18T01:18:07.616362974Z","cvss":[{"version":"3.1","score":2.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"UBUNTU-CVE-2023-39804","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2023-11-30T00:00:00Z","modified":"2026-02-04T02:29:47.18359Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"AZL-52625","title":"CVE-2023-39804 affecting package tar for versions less than 1.34-3","description":"In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.","status":"published","published":"2024-03-27T04:15:08Z","modified":"2026-04-21T04:33:30.113925Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"CLSA-2024-1706026767","title":"Fix CVE(s): CVE-2023-39804","description":"   * SECURITY UPDATE: denial of service attack\n     - debian/patches/CVE-2023-39804.patch: Fix handling of extended\n       header prefixes.\n     - CVE-2023-39804.patch","status":"published","published":"2024-01-23T16:19:30Z","modified":"2026-06-04T10:04:17.444248Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1710436683","title":"Fix CVE(s): CVE-2023-39804","description":"   * SECURITY UPDATE: denial of service attack\n     - debian/patches/CVE-2023-39804.patch: Fix handling of extended\n       header prefixes.\n     - CVE-2023-39804","status":"published","published":"2024-03-14T17:18:06Z","modified":"2026-06-04T10:04:20.133181Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2025-1762535960","title":"tar: Fix of CVE-2023-39804","description":"- CVE-2023-39804: fix crash in GNU tar caused by incorrect handling of\n  extended PAX xattr headers leading to memory corruption (DoS)","status":"published","published":"2025-11-07T17:19:23Z","modified":"2026-06-01T00:33:23.05913464Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1762536241","title":"tar: Fix of CVE-2023-39804","description":"- CVE-2023-39804: fix crash in GNU tar caused by incorrect handling of\n  extended PAX xattr headers leading to memory corruption (DoS)","status":"published","published":"2025-11-07T17:24:05Z","modified":"2026-06-01T00:33:12.281454917Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1778820779","title":"tar: Fix of CVE-2023-39804","description":"- CVE-2023-39804: fix crash on PAX archive with malformed extended header\n  attributes in locate_handler and xattr_decoder","status":"published","published":"2026-05-15T10:50:05Z","modified":"2026-06-01T00:32:30.973468708Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778828497","title":"tar: Fix of CVE-2023-39804","description":"- CVE-2023-39804: fix crash on PAX archive with malformed extended header\n  attributes in locate_handler and xattr_decoder","status":"published","published":"2026-05-15T08:41:57Z","modified":"2026-06-01T00:32:52.389688372Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-3755-1","title":"tar - security update","status":"published","published":"2024-03-09T00:00:00Z","modified":"2026-03-09T01:18:04.185679Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:13751-1","title":"tar-1.35-2.1 on GA media","description":"These are all security issues fixed in the tar-1.35-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:59.96254Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0070-1","title":"Security update for tar","description":"This update for tar fixes the following issues:\n\n- CVE-2023-39804: Fixed  extension attributes in PAX archives incorrect hanling (bsc#1217969).\n","status":"published","published":"2024-01-09T17:29:55Z","modified":"2026-02-04T04:40:08.206733Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:0070-2","title":"Security update for tar","description":"This update for tar fixes the following issues:\n\n- CVE-2023-39804: Fixed  extension attributes in PAX archives incorrect hanling (bsc#1217969).\n","status":"published","published":"2024-01-09T17:30:14Z","modified":"2025-05-02T04:35:18.075372Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:0071-1","title":"Security update for tar","description":"This update for tar fixes the following issues:\n\n- CVE-2023-39804: Incorrectly handled extension attributes in PAX archives can lead to a crash (bsc#1217969)\n","status":"published","published":"2024-01-10T08:38:14Z","modified":"2026-02-04T04:23:37.829786Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6543-1","title":"tar vulnerability","description":"It was discovered that tar incorrectly handled extended attributes in PAX\narchives. An attacker could use this issue to cause tar to crash, resulting in a\ndenial of service.\n","status":"published","published":"2023-12-11T00:26:33Z","modified":"2026-06-29T13:46:57.43745226Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}