PT-2020-8615 · Opensuse · Xar

Published 2026-06-22 · Updated 2026-06-23 · CVE-2018-17094

OSV

This update for xar fixes the following issues:

Changes in xar:

• Switch to the maintained Apple xar lineage (build 503, versioned 1.8.0.0.503): the mackyle 1.6.1 fork this package tracked has been dead since 2012, and Debian, Fedora and Gentoo all moved to Apple's xar (apple-oss-distributions/xar). This resolves the long-standing NULL-pointer dereferences in xar get path() and xar unserialize() when parsing malformed archives:

• CVE-2017-11124 (boo#1047875)
• CVE-2017-11125 (boo#1047874)
• CVE-2018-17093 (boo#1108595)
• CVE-2018-17094 (boo#1108596)

Related Identifiers

CVE-2018-17094

OPENSUSE-SU-2026:11103-1

OPENSUSE-SU-2026:21153-1

Affected Products

Xar

References · 10

• https://osv.dev/vulnerability/openSUSE-SU-2026:11103-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21153-1 · Vendor Advisory
• https://bugzilla.suse.com/1047874 · Note
• https://bugzilla.suse.com/1108595 · Note
• https://suse.com/security/cve/CVE-2017-11124 · Note
• https://suse.com/security/cve/CVE-2018-17094 · Note
• https://bugzilla.suse.com/1047875 · Note
• https://suse.com/security/cve/CVE-2018-17093 · Note
• https://bugzilla.suse.com/1108596 · Note
• https://suse.com/security/cve/CVE-2017-11125 · Note