PT-2023-27111 · Gnu+5 · Gnu Tar+5

Salvatore Bonaccorso · Published 2023-11-30 · Updated 2025-07-29 · CVE-2023-39804

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU tar versions prior to 1.35

Description The issue arises from mishandled extension attributes in a PAX archive, which can cause an application crash in xheader.c.

Recommendations For GNU tar versions prior to 1.35, update to version 1.35 or later to resolve the issue.

Fix

Related Identifiers

AZL-52625

CVE-2023-39804

DLA-3755-1

OESA-2023-1991

OESA-2023-1992

OESA-2023-1993

OESA-2023-1994

OESA-2023-2002

OPENSUSE-SU-2024:13751-1

SUSE-SU-2024:0070-1

SUSE-SU-2024:0070-2

SUSE-SU-2024:0071-1

SUSE-SU-2024_0070-1

SUSE-SU-2024_0071-1

USN-6543-1

Affected Products

Astra Linux

Gnu Tar

Linuxmint

Red Os

Suse

Ubuntu

References · 41

• https://osv.dev/vulnerability/SUSE-SU-2024:0070-2 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-52625 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4 · Patch
• https://osv.dev/vulnerability/OESA-2023-1993 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-39804 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1991 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39804 · Security Note
• https://ubuntu.com/security/notices/USN-6543-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1992 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-2002 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0070-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-39804 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6543-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-39804 · Vendor Advisory