Description
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openEuler | openEuler 22.03 LTS | libtar 1.2.20-21 | — |
| openEuler | openEuler 20.03 LTS SP1 | libtar 1.2.20-19 | — |
| openEuler | openEuler 20.03 LTS SP3 | libtar 1.2.20-19 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libtar | 1.2.20-3.1 | openSUSE-SU-2026:11092-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libtar | 1.2.20-11 | — |
| Azure Linux 2 (CBL-Mariner) | libtar | 1.2.20-11 | — |
Advisories 1
- openSUSE-SU-2026:11092-1 libtar-1.2.20-3.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
References
- https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2021-33640&packageName=libtar
- FEDORA-2022-88772d0a2d vendor-advisory
- FEDORA-2022-ccc68b06cc vendor-advisory