Fedora has issued an advisory today (December 28): https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/ Mageia 8 is also affected.
Whiteboard: (none) => MGA8TOOStatus comment: (none) => Patch available from Fedora
CC: (none) => nicolas.salguero
Assigning gobally as libtar has no evident maintainer. NicolasS (who did last CVE update) is already CC'd.
Assignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated packages fix a security vulnerability: After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free). (CVE-2021-33640) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33640 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/ ======================== Updated packages in core/updates_testing: ======================== libtar-1.2.20-9.2.mga8 lib(64)tar0-1.2.20-9.2.mga8 lib(64)tar-devel-1.2.20-9.2.mga8 from SRPM: libtar-1.2.20-9.2.mga8.src.rpm
Assignee: pkg-bugs => qa-bugsVersion: Cauldron => 8Status: NEW => ASSIGNEDCVE: (none) => CVE-2021-33640Whiteboard: MGA8TOO => (none)Source RPM: libtar-1.2.20-11.mga9.src.rpm => libtar-1.2.20-9.1.mga8.src.rpmStatus comment: Patch available from Fedora => (none)
MGA8-64 MATE on Acer Aspire 5253 No installation issues. Re-using the test files from bug 30821. $ cd libtartest/ $ libtar -c tartest.tar test.txt $ rm -f test.txt $ libtar -x tartest.tar $ cat test.txt test test test So testing is OK.
Whiteboard: (none) => MGA8-64-OKCC: (none) => herman.viaene
Validating. Advisory in comment 2.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0488.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED