CVE-2021-33643

NameCVE-2021-33643
DescriptionAn attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4033-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libtar (PTS)bookworm1.2.20-8+deb12u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libtarsourcebullseye1.2.20-8+deb12u1~deb11u1DLA-4033-1
libtarsourcebookworm1.2.20-8+deb12u1
libtarsource(unstable)(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2121289
(not-upstream) patch from OpenEuler: https://gitee.com/src-openeuler/libtar/blob/master/openEuler-CVE-2021-33643-CVE-2021-33644.patch
Search for package or bug name: Reporting problems