Libtar

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:feep:libtar:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorFeep (8cf60191-6bb6-5614-a331-e2c556317477)
ProductLibtar (712d516f-d56d-5280-9f51-d203b1e7d71c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:bitbucket/xvjau/libtar purl2cpe 2026-06-01 10:12:09.198128
pkg:deb/debian/libtar purl2cpe 2026-06-01 10:12:09.198131
pkg:deb/ubuntu/libtar purl2cpe 2026-06-01 10:12:09.198133
pkg:github/openeuler-baseservice/libtar purl2cpe 2026-06-01 10:12:09.198136
pkg:github/tklauser/libtar purl2cpe 2026-06-01 10:12:09.198139
pkg:github/troian/libtar purl2cpe 2026-06-01 10:12:09.198142
pkg:gitlab/redhat/libtar purl2cpe 2026-06-01 10:12:09.198144
pkg:rpm/centos/libtar purl2cpe 2026-06-01 10:12:09.198147
pkg:rpm/fedora/libtar purl2cpe 2026-06-01 10:12:09.198150
pkg:rpm/opensuse/libtar purl2cpe 2026-06-01 10:12:09.198157

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-33646 vulnerable 2026-06-08 05:32:11.984639 Details available
The th_read() function doesn’t free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.
Published: 2022-08-09T00:00:00.000Z
Updated: 2025-11-03T20:33:40.032Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33645 vulnerable 2026-06-08 05:32:11.984116 Details available
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.
Published: 2022-08-09T00:00:00.000Z
Updated: 2025-11-03T20:33:38.619Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33644 vulnerable 2026-06-08 05:32:11.983461 Details available
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
Published: 2022-08-09T00:00:00.000Z
Updated: 2025-11-03T20:33:37.233Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-33643 vulnerable 2026-06-08 05:32:11.980393 Details available
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.
Published: 2022-08-09T00:00:00.000Z
Updated: 2026-06-23T14:42:04.986Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2013-4420 vulnerable 2026-06-08 05:04:36.079150 Details available
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
Published: 2014-02-20T16:00:00.000Z
Updated: 2024-08-06T16:45:14.493Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2013-4397 vulnerable 2026-06-08 05:04:35.958348 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.