SUSE-SU-2026:2615-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20262615-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2615-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:2615-1
Upstream
  • CVE-2025-45582
Related
  • CVE-2025-45582
Published
2026-06-24T09:02:36Z
Modified
2026-06-25T06:15:06Z
Summary
Security update for tar
Details

This update for tar fixes the following issues:

Upgrade tar to version 1.34 (jsc#PED-16073).

Security issues fixed:

  • CVE-2025-45582: file overwrite via directory traversal in crafted TAR archives (bsc#1246399).

Other updates and bugfixes:

  • Changes from 1.28:
    • New --one-top-level option: extract all files into a subdirectory named after the archive base name
    • New --sort option: sort directory entries by name or inode when creating archives
    • New exclusion options: --exclude-ignore, --exclude-ignore-recursive, and --exclude-vcs-ignores
    • New checkpoint action: totals; extended checkpoint format specifiers
    • Official tar(1) and rmt(8) manpages now provided upstream
    • Refuse to read from or write archives to a tty device
  • Changes from 1.29:
    • New --verbatim-files-from option: treat each line in a file list as a literal file name regardless of leading dashes
  • Changes from 1.30:
    • Member names containing '..' components are now skipped on extraction (security hardening)
    • Erroneous use of position-sensitive options is now reported
    • --numeric-owner now applies to private (pax) headers too
    • Fixed --delay-directory-restore in several edge cases
    • New --warnings=failed-read option to suppress unreadable-file warnings when combined with --ignore-failed-read
  • Changes from 1.32:
    • POSIX extended format headers no longer include PID by default
    • Wildcards in --exclude-vcs-ignore mode no longer match slashes
    • Fixed --no-overwrite-dir option
    • Fixed handling of chained renames in incremental backups
    • Link counting works for file names supplied via -T
  • Changes from 1.33:
    • Fix extraction over pipe
    • Fix memory leak in read_header
    • Fix extraction when . and .. are unreadable
    • Gracefully handle duplicate symlinks when extracting
    • Re-initialise supplementary groups when switching to user privileges
References

Affected packages

SUSE:Linux Enterprise Server 12 SP5-LTSS / tar

Package

Name
tar
Purl
pkg:rpm/suse/tar&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.34-15.27.1

Ecosystem specific 

{
    "binaries":  [
        {
            "tar":  "1.34-15.27.1",
            "tar-lang":  "1.34-15.27.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2615-1.json"

SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 / tar

Package

Name
tar
Purl
pkg:rpm/suse/tar&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.34-15.27.1

Ecosystem specific 

{
    "binaries":  [
        {
            "tar":  "1.34-15.27.1",
            "tar-lang":  "1.34-15.27.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2615-1.json"