CVE-2021-33644: libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap out-of-bounds read)
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnulongname, causing an out-of-bounds read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libtarto a version that resolves this vulnerability.Fixed in 1.2.20-8+deb12u1~deb11u1Fixed in 1.2.20-8+deb12u1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33644?
CVE-2021-33644 has a medium severity rating due to the potential for an out-of-bounds read.
How do I fix CVE-2021-33644?
To fix CVE-2021-33644, update to the latest version of libtar that addresses this vulnerability.
Which software is affected by CVE-2021-33644?
CVE-2021-33644 affects various versions of libtar and specific releases of Huawei's openEuler and Fedora.
Can CVE-2021-33644 be exploited remotely?
Yes, CVE-2021-33644 can potentially be exploited by an attacker submitting a crafted tar file.
What type of vulnerability is CVE-2021-33644?
CVE-2021-33644 is classified as a memory corruption vulnerability due to an out-of-bounds read issue.