CVE-2022-48303

CVSS V2 None CVSS V3 None

Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Overview

CVE ID
CVE-2022-48303

Assigner
cve@mitre.org

Vulnerability Status
Modified

Published Version
2023-01-30T04:15:08

Last Modified Date
2023-03-27T00:15:08

Weakness Enumerations

CWE	URL
CWE-125	http://cwe.mitre.org/data/definitions/125.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:gnu:tar::::::::	1	OR		1.34

References

Reference URL	Reference Tags
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/
https://savannah.gnu.org/bugs/?62387	Exploit Vendor Advisory
https://savannah.gnu.org/patch/?10307	Patch Vendor Advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2022-48303
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48303

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 06:54:57				Added to TrackCVE
2023-04-17 06:55:01			Weakness Enumeration	new