Summary
It was discovered that tar incorrectly handled symlinks when extracting
archives. An attacker could possibly use this issue to overwrite arbitrary
files.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | tar | 1.34+dfsg-1ubuntu0.1.22.04.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | tar | 1.35+dfsg-3ubuntu0.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | tar | 1.35+dfsg-4ubuntu0.2 |
Vulnerabilities 1
-
Medium 4.1
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step pro…
References
-
report
https://ubuntu.com/security/CVE-2025-45582