tar security update
GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fix(es): A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.(CVE-2026-18508)
OESA-2026-4081
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:OESA-2026-4081
tar
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.35-8.oe2403sp4
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.35-8.oe2403sp4"
}
]
}
],
"package": {
"name": "tar",
"purl": "pkg:rpm/openEuler/tar&distro=openEuler-24.03-LTS-SP4",
"ecosystem": "openEuler:24.03-LTS-SP4"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4081.json"
},
"ecosystem_specific": {
"src": [
"tar-1.35-8.oe2403sp4.src.rpm"
],
"noarch": [
"tar-help-1.35-8.oe2403sp4.noarch.rpm"
],
"x86_64": [
"tar-1.35-8.oe2403sp4.x86_64.rpm",
"tar-debuginfo-1.35-8.oe2403sp4.x86_64.rpm",
"tar-debugsource-1.35-8.oe2403sp4.x86_64.rpm"
],
"aarch64": [
"tar-1.35-8.oe2403sp4.aarch64.rpm",
"tar-debuginfo-1.35-8.oe2403sp4.aarch64.rpm",
"tar-debugsource-1.35-8.oe2403sp4.aarch64.rpm"
]
}
}
]Publisher severity
medium
Source reference: /database_specific/severity
- Event
- #14701 · Revision 1
- Added to Heist Feed
- Publisher date