REDHAT-BUG-2149722: Buffer Overflow
A Heap Buffer Overflow issue takes place at fromheader() in list.c in the tar application. The issue occurs when attempting to read files with old V7 tar format with an especially crafted checksum. As a result, an invalid memory read that leads to a conditional jump or move operation on uninitialised memory values takes place.
Reference:
https://savannah.gnu.org/bugs/?62387
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2149722?
The severity of REDHAT-BUG-2149722 is high due to the potential for a heap buffer overflow that can lead to security vulnerabilities.
How do I fix REDHAT-BUG-2149722?
To fix REDHAT-BUG-2149722, users should upgrade to the latest version of GNU tar where the vulnerability has been patched.
What causes the vulnerability in REDHAT-BUG-2149722?
The vulnerability in REDHAT-BUG-2149722 is caused by a heap buffer overflow that occurs in the from_header() function when processing specifically crafted files in old V7 tar format.
Which software is affected by REDHAT-BUG-2149722?
The software affected by REDHAT-BUG-2149722 is GNU tar.
What type of vulnerability is REDHAT-BUG-2149722?
REDHAT-BUG-2149722 is classified as a heap buffer overflow vulnerability.