Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2023-39804

Published: 30 November 2023

[A stack overflow vulnerability exists in GNU Tar up to including v1.34. The bug exists in the function xattr_decoder() in xheader.c, where alloca() is used and it may overflow the stack if a sufficiently long xattr key is used. The vulnerability can be triggered when extracting a tar/pax archive that contains such a long xattr key.]

Notes

AuthorNote
alexmurray
Fixed in upstream version 1.35

Priority

Medium

Status

Package Release Status
tar
Launchpad, Ubuntu, Debian
bionic
Released (1.29b-2ubuntu0.4+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
focal
Released (1.30+dfsg-7ubuntu0.20.04.4)
lunar
Released (1.34+dfsg-1.2ubuntu0.2)
mantic
Released (1.34+dfsg-1.2ubuntu1.1)
upstream Needed

jammy
Released (1.34+dfsg-1ubuntu0.1.22.04.2)
trusty
Released (1.27.1-1ubuntu0.1+esm4)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
xenial
Released (1.28-2.1ubuntu0.2+esm3)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
Patches:
upstream: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4