The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0136 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2021-33640:
      After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in     the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the     released memory is used (use-after-free).
      CVE-2021-33645:
      A flaw was found in libtar. This security vulnerability occurs because the th_read() function in libtar     doesnt free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.

      CVE-2021-33646:
      A flaw was found in libtar. This security vulnerability occurs because the th_read() function in libtar     doesnt free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.

      CVE-2021-33643:
      A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with the size in     the header struct being 0 to trigger a calling of malloc(0) for a variable gnu_longlink, causing an out-     of-bounds read.

      CVE-2021-33644:
      A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with size in     header struct being 0 to trigger a calling of malloc(0) for a variable gnu_longname, causing an out-of-     bounds read.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5561:01 advisory.

    * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)
      * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)
      * libtar: memory leak found in th_read() function (CVE-2021-33645)
      * libtar: memory leak found in th_read() function (CVE-2021-33646)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libtar package has been released.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ccc68b06cc advisory.

    - fix use-after-free bugs introduced by incorrect memleak fixes (CVE-2021-33640)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2898 advisory.

    The libtar packages contain a C library for manipulating tar archives. The library supports both the     strict POSIX tar format and many of the commonly used GNU extensions.

    Security Fix(es):

    * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)

    * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)

    * libtar: memory leak found in th_read() function (CVE-2021-33645)

    * libtar: memory leak found in th_read() function (CVE-2021-33646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
239260	TencentOS Server 3: libtar (TSSA-2023:0136)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
292931	MiracleLinux 8 : libtar-1.2.20-17.el8 (AXSA:2023-5561:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
332324	Photon OS 5.0: Libtar PHSA-2023-5.0-91-0010	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/2	critical
203367	Photon OS 4.0: Libtar PHSA-2022-4.0-0231	Nessus	PhotonOS Local Security Checks	2024/7/23	2026/11/2	critical
169344	Fedora 36 : libtar (2022-ccc68b06cc)	Nessus	Fedora Local Security Checks	2022/12/28	2024/11/14	critical
175902	RHEL 8 : libtar (RHSA-2023:2898)	Nessus	Red Hat Local Security Checks	2023/5/17	2024/11/7	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical