PT-2019-19939 · Gnu+6 · Gnu Tar+6

Padma81 · Published 2019-02-24 · Updated 2025-08-28 · CVE-2019-9923

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GNU Tar versions prior to 1.32

Description The issue arises from a NULL pointer dereference in the pax decode header function within sparse.c when parsing certain archives with malformed extended headers.

Recommendations For GNU Tar versions prior to 1.32, update to version 1.32 or later to resolve the issue.

Fix

Infinite Loop

NULL Pointer Dereference

Weakness Enumeration

CWE-835

CWE-476

Related Identifiers

ALT-PU-2019-1302

BDU:2025-10839

CVE-2019-9923

MGASA-2019-0164

OPENSUSE-SU-2019:1237-1

OPENSUSE-SU-2019_1237-1

OPENSUSE-SU-2022_1548-1

OPENSUSE-SU-2024:11422-1

SUSE-SU-2019:0926-1

SUSE-SU-2019:14215-1

SUSE-SU-2019_14215-1

SUSE-SU-2020:2806-1

SUSE-SU-2022:1548-1

SUSE-SU-2022_1548-1

USN-4692-1

Affected Products

Alt Linux

Astra Linux

Gnu Tar

Linuxmint

Red Os

Suse

Ubuntu

References · 49

• https://ubuntu.com/security/notices/USN-4692-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-9923 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1548-1 · Vendor Advisory
• https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11422-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-9923 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9923 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9923 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-4692-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0926-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9923 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:14215-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0164 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0164.html · Security Note