ALSA-2026:61586
See a problem?- Import Source
- https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:61586.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALSA-2026:61586
- Related
- Published
- 2026-08-31T00:00:00Z
- Modified
- 2026-09-02T10:55:56.642026832Z
- Summary
- Moderate: tar security, bug fix, and enhancement update
- Details
-
The GNU tar program can save multiple files in an archive and restore files from an archive.
Security Fix(es):
- tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)
- tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)
- tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)
Bug Fix(es) and Enhancement(s):
- tar: --one-top-level with absolute path fails (JIRA:AlmaLinux-143906)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- References
-
- https://access.redhat.com/errata/RHSA-2026:61586
- https://access.redhat.com/security/cve/CVE-2026-18477
- https://access.redhat.com/security/cve/CVE-2026-18508
- https://access.redhat.com/security/cve/CVE-2026-5704
- https://bugzilla.redhat.com/2455360
- https://bugzilla.redhat.com/2509735
- https://bugzilla.redhat.com/2509843
- https://errata.almalinux.org/10/ALSA-2026-61586.html