Description
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =3.11.2-6 || =3.11.2-6+deb12u1 || =3.11.2-6+deb12u2 || =3.11.2-6+deb12u3 || =3.11.2-6+deb12u4 || =3.11.2-6+deb12u5 || =3.11.2-6+deb12u6 || =3.11.2-6+deb12u7 || =3.11.3-1 || =3.11.3-2 || =3.11.4-1 || =3.11.5-1 || =3.11.5-2 || =3.11.5-3 || =3.11.6-1 || =3.11.6-2 || =3.11.6-3 || =3.11.6-3~hurd.2 || =3.11.7-1 || =3.11.7-2 || =3.11.8-1 || =3.11.8-1.1~exp1 || =3.11.8-1.1~exp2 || =3.11.8-2 || =3.11.8-3 || =3.11.8-3+hurd.1 || =3.11.9-1 | - |
debian 13 | | =3.13.5-2 || >=0 <3.13.5-2+deb13u1 | 3.13.5-2+deb13u1 |
debian 11 | | =2.7.18-10 || =2.7.18-11 || =2.7.18-12 || =2.7.18-13 || =2.7.18-13.1 || =2.7.18-13.1~exp1 || =2.7.18-13.2 || =2.7.18-8 || =2.7.18-8+deb11u1 || =2.7.18-9 | - |
debian 14 | | =3.13.11-1 || =3.13.12-1 || =3.13.5-2 || =3.13.6-1 || =3.13.7-1 || =3.13.8-1 || =3.13.9-1 | - |
debian 14 | | =3.14.0-1 || =3.14.0-2 || =3.14.0-3 || =3.14.0-4 || =3.14.0-5 || =3.14.0~a7-1 || =3.14.0~b1-1 || =3.14.0~b2-1 || =3.14.0~b3-1 || =3.14.0~b4-1 || =3.14.0~rc1-1 || =3.14.0~rc2-1 || =3.14.0~rc3-1 || =3.14.2-1 || =3.14.3-1 || =3.14.3-2 || =3.14.3-3 || >=0 <3.14.3-4 | 3.14.3-4 |
debian 11 | | =3.9.2-1 || =3.9.2-1+deb11u1 || =3.9.2-1+deb11u2 || =3.9.2-1+deb11u3 || =3.9.2-1+deb11u4 || =3.9.2-1+deb11u5 || =3.9.2-1+deb11u6 || >=0 <3.9.2-1+deb11u7 | 3.9.2-1+deb11u7 |
