SUSE-SU-2026:5160-1: Security update for tar

Q: Which systems are covered by this update?

The update applies to tar packages on SUSE Linux Enterprise Micro 5.4 and 5.5, including Micro for Rancher 5.4, and the SUSE Basesystem Module 15-SP7. Listed architectures include aarch64, x86_64, s390x, and, where applicable, ppc64le.

Q: What archive extraction scenarios are affected?

CVE-2026-18477 affects incremental dumpdir restoration involving rename handling and can allow a restored path to escape its intended location. CVE-2026-18508 affects extraction using --one-top-level when archive hardlink targets are not confined to the top-level directory, enabling arbitrary file overwrite.

Q: What should be prioritized when patching cannot be immediate?

Avoid restoring untrusted incremental archives and avoid extracting untrusted archives with --one-top-level, particularly where hardlinks may be present. These are the operations identified as affected by the update.

Published Nov 10, 2026

Updated

This update for tar fixes the following issues:

- CVE-2026-18477: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (bsc#1274489). - CVE-2026-18508: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (bsc#1274490).

Other sources

This update for tar fixes the following issues: CVE-2026-18477: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (bsc#1274489). CVE-2026-18508: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (bsc#1274490).

— SUSE

Affected Software

23 affected componentsFixes available

suse/tar<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar<1.34-150000.3.45.1

1.34-150000.3.45.1

All of the following

SUSE SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)

Any of the following

suse/tar<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debuginfo<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debugsource<1.34-150000.3.45.1

1.34-150000.3.45.1

All of the following

SUSE SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)

Any of the following

suse/tar<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debuginfo<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debugsource<1.34-150000.3.45.1

1.34-150000.3.45.1

All of the following

SUSE SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/tar<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debuginfo<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debugsource<1.34-150000.3.45.1

1.34-150000.3.45.1

All of the following

SUSE Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/tar-rmt-debuginfo<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debuginfo<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-debugsource<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar<1.34-150000.3.45.1

1.34-150000.3.45.1

suse/tar-rmt<1.34-150000.3.45.1

1.34-150000.3.45.1

All of the following

SUSE Basesystem Module 15-SP7 (noarch)

suse/tar-lang<1.34-150000.3.45.1

1.34-150000.3.45.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/tar to a version that resolves this vulnerability.
Fixed in 1.34-150000.3.45.1
Upgrade
Upgrade suse/tar-debuginfo to a version that resolves this vulnerability.
Fixed in 1.34-150000.3.45.1
Upgrade
Upgrade suse/tar-debugsource to a version that resolves this vulnerability.
Fixed in 1.34-150000.3.45.1
Upgrade
Upgrade suse/tar-rmt-debuginfo to a version that resolves this vulnerability.
Fixed in 1.34-150000.3.45.1
Upgrade
Upgrade suse/tar-rmt to a version that resolves this vulnerability.
Fixed in 1.34-150000.3.45.1
Upgrade
Upgrade suse/tar-lang to a version that resolves this vulnerability.
Fixed in 1.34-150000.3.45.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.4-2026-5160
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2026-5160
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP7-2026-5160

Event History

Nov 10, 2026

Advisory Published

via OSV·09:41 AM

Data Sourced

via OSV·09:41 AM

DescriptionAffected Software

Advisory Published

via SUSE·09:41 AM

Data Sourced

via SUSE·09:41 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems are covered by this update?

The update applies to tar packages on SUSE Linux Enterprise Micro 5.4 and 5.5, including Micro for Rancher 5.4, and the SUSE Basesystem Module 15-SP7. Listed architectures include aarch64, x86_64, s390x, and, where applicable, ppc64le.

What archive extraction scenarios are affected?

CVE-2026-18477 affects incremental dumpdir restoration involving rename handling and can allow a restored path to escape its intended location. CVE-2026-18508 affects extraction using --one-top-level when archive hardlink targets are not confined to the top-level directory, enabling arbitrary file overwrite.

What should be prioritized when patching cannot be immediate?

Avoid restoring untrusted incremental archives and avoid extracting untrusted archives with --one-top-level, particularly where hardlinks may be present. These are the operations identified as affected by the update.

SUSE-SU-2026:5160-1: Security update for tar

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are covered by this update?

What archive extraction scenarios are affected?

What should be prioritized when patching cannot be immediate?

Company

Resources

Contact

Frequently Asked Questions

Which systems are covered by this update?

What archive extraction scenarios are affected?

What should be prioritized when patching cannot be immediate?