Description
Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (colon) character.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpio | 2.11-1 | — |
| Debian 14 | tar | 1.23-1 | — |
| Debian 13 | cpio | 2.11-1 | — |
| Debian 13 | tar | 1.23-1 | — |
| Debian 12 | cpio | 2.11-1 | — |
| Debian 12 | tar | 1.23-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cpio | 2.6-23.el5_4.1 | RHSA-2010:0144 |
| RHEL 5 | tar | 2:1.15.1-23.0.1.el5_4.2 | RHSA-2010:0141 |
| RHEL 4 | cpio | 2.5-16.el4_8.1 | RHSA-2010:0143 |
| RHEL 4 | tar | 1.14-13.el4_8.1 | RHSA-2010:0141 |
| RHEL 3 | cpio | 2.5-6.RHEL3 | RHSA-2010:0145 |
| RHEL 3 | tar | 1.13.25-16.RHEL3 | RHSA-2010:0142 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cpio | 2.12-3.90 | openSUSE-SU-2024:10143-1 |
| openSUSE Tumbleweed | tar | 1.29-2.1 | openSUSE-SU-2024:10382-1 |
Advisories 7
- RHSA-2010:0145 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0144 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0142 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0143 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0141 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10143-1 cpio-2.12-3.90 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10382-1 tar-1.29-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2010:0142 vendor-advisory
- FEDORA-2010-2895 vendor-advisory
- MDVSA-2010:065 vendor-advisory
- ADV-2010-1107 vdb-entry
- RHSA-2010:0144 vendor-advisory
- ADV-2010-0629 vdb-entry
- http://www.agrs.tu-berlin.de/index.php?id=78327
- SUSE-SR:2010:011 vendor-advisory
- 38988 third-party-advisory
- GLSA-201111-11 vendor-advisory
- FEDORA-2010-4309 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=564368
- ADV-2010-0687 vdb-entry
- ADV-2010-0639 vdb-entry
- https://issues.rpath.com/browse/RPL-3219
- oval:org.mitre.oval:def:6907 vdb-entry signature
- ADV-2010-0628 vdb-entry
- RHSA-2010:0141 vendor-advisory
- FEDORA-2010-4321 vendor-advisory
- USN-2456-1 vendor-advisory
- 39008 third-party-advisory
- FEDORA-2010-4302 vendor-advisory
- 20101027 rPSA-2010-0070-1 cpio tar mailing-list
- oval:org.mitre.oval:def:10277 vdb-entry signature
- RHSA-2010:0145 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 38869 third-party-advisory
- ADV-2010-0729 vdb-entry
- FEDORA-2010-4306 vendor-advisory
- ADV-2010-0728 vdb-entry
- 62950 vdb-entry