CVE-2022-48303
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48303
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48303.json
- Related
- Published
- 2023-01-30T04:15:08Z
- Modified
- 2023-11-29T10:00:57.477685Z
- Details
-
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
- References
-
- https://savannah.gnu.org/bugs/?62387
- https://savannah.gnu.org/patch/?10307
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/
Affected packages
Alpine:v3.14 / tar
Package
- Name
- tar
Alpine:v3.15 / tar
Package
- Name
- tar
Alpine:v3.16 / tar
Package
- Name
- tar
Alpine:v3.17 / tar
Package
- Name
- tar