Description
Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | libtar | 1.2.20-1 | — |
| Debian 7 | libtar | 1.2.16-1+deb7u1 | DSA-2817-1 |
| Debian 6.0 | libtar | 1.2.11-6+deb6u1 | DSA-2817-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libtar +1 | 1.2.11-17.el6_4.1 | RHSA-2013:1418 |
Advisories 2
- RHSA-2013:1418 Red Hat Security Advisory: libtar security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2817-1 libtar - Multiple integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- [libtar] 20131009 ANNOUNCE: libtar version 1.2.20 mailing-list
- RHSA-2013:1418 vendor-advisory
- 55253 third-party-advisory
- 1029166 vdb-entry
- https://source.android.com/security/bulletin/2018-01-01
- [oss-security] 20131010 Re: Integer overflow in libtar (<= 1.2.19) mailing-list
- 55188 third-party-advisory
- http://repo.or.cz/w/libtar.git/commitdiff/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04
- 1040106 vdb-entry
- DSA-2817 vendor-advisory
- 62922 vdb-entry
- [oss-security] 20131010 Integer overflow in libtar (<= 1.2.19) mailing-list