Red Hat: CVE-2022-48303: heap buffer overflow at from_header() in list.c via specially crafted checksum (Multiple Advisories)

Red Hat: CVE-2022-48303: heap buffer overflow at from_header() in list.c via specially crafted checksum (Multiple Advisories)

Severity

5

CVSS

(AV:L/AC:M/Au:N/C:N/I:N/A:C)

Published

01/30/2023

Created

02/22/2023

Added

02/22/2023

Modified

01/28/2025

Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Solution(s)

• redhat-upgrade-tar
• redhat-upgrade-tar-debuginfo
• redhat-upgrade-tar-debugsource

References

• CVE-2022-48303
• RHSA-2023:0842
• RHSA-2023:0959
• RHSA-2023:5610