Description
Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tar | 1.15.1-3 | — |
| Debian 13 | tar | 1.15.1-3 | — |
| Debian 12 | tar | 1.15.1-3 | — |
| Debian 3.1 | tar | 1.14-2.1 | DSA-987-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | tar | 1.14-9.RHEL4 | RHSA-2006:0232 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tar | 1.34-2.2 | openSUSE-SU-2024:11422-1 |
Advisories 3
- RHSA-2006:0232 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-987-1 tar - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11422-1 tar-1.34-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 2006-0010 vendor-advisory
- FLSA:183571-2 vendor-advisory
- 1015705 vdb-entry
- oval:org.mitre.oval:def:5978 vdb-entry signature
- 18999 third-party-advisory
- 24966 third-party-advisory
- SUSE-SR:2006:005 vendor-advisory
- TA07-072A third-party-advisory
- OpenPKG-SA-2006.006 vendor-advisory
- 18976 third-party-advisory
- USN-257-1 vendor-advisory
- 23371 vdb-entry
- 19236 third-party-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- DSA-987 vendor-advisory
- RHSA-2006:0232 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=305391
- 19093 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- 543 third-party-advisory
- 480 third-party-advisory
- MDKSA-2006:046 vendor-advisory
- 19152 third-party-advisory
- [Bug-tar] 20060220 tar 1.15.90 released mailing-list
- 241646 vendor-advisory
- 18973 third-party-advisory
- TA07-109A third-party-advisory
- 16764 vdb-entry
- ADV-2008-2518 vdb-entry
- 19130 third-party-advisory
- oval:org.mitre.oval:def:5252 vdb-entry signature
- oval:org.mitre.oval:def:9295 vdb-entry signature
- 20042 third-party-advisory
- oval:org.mitre.oval:def:5993 vdb-entry signature
- ADV-2006-0684 vdb-entry
- 19016 third-party-advisory
- ADV-2007-0930 vdb-entry
- gnu-tar-pax-headers-bo(24855) vdb-entry
- APPLE-SA-2007-04-19 vendor-advisory
- ADV-2007-1470 vdb-entry
- oval:org.mitre.oval:def:6094 vdb-entry signature
- 24479 third-party-advisory
- GLSA-200603-06 vendor-advisory