Ubuntu: (Multiple Advisories) (CVE-2022-48303): tar vulnerability

Ubuntu: (Multiple Advisories) (CVE-2022-48303): tar vulnerability

Severity

5

CVSS

(AV:L/AC:M/Au:N/C:N/I:N/A:C)

Published

01/30/2023

Created

03/29/2023

Added

03/22/2023

Modified

01/28/2025

Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Solution(s)

• ubuntu-pro-upgrade-tar

References

• https://attackerkb.com/topics/cve-2022-48303
• CVE - 2022-48303
• USN-5900-1
• USN-5900-2