SUSE-SU-2019:14215-1

Dashboard / Vulnerabilities / SUSE-SU-2019:14215-1

SUSE-SU-2019:14215-1

Summary: Security update for tar

Details: This update for tar to version 1.27.1 fixes the following issues: tar 1.27.1 brings following changes (jsc#ECO-339) * Sparse files with large data * No backticks in quoting * --owner and --group names and numbers * Support for POSIX ACLs, extended attributes and SELinux context. * Passing command line arguments to external commands. * New configure option --enable-gcc-warnings, intended for debugging. * New warning control option --warning=[no-]record-size * New command line option --keep-directory-symlink * Fix unquoting of file names obtained via the -T option. * Fix GNU long link header timestamp (backward compatibility). Security issues fixed: - CVE-2019-9923: Fixed a denial of service while parsing certain archives with malformed extended headers in pax_decode_header() (bsc#1130496). - CVE-2018-20482: Fixed a denial of service when the '--sparse' option mishandles file shrinkage during read access (bsc#1120610).

References: https://www.suse.com/support/update/announcement/2019/suse-su-201914215-1/, https://bugzilla.suse.com/1120610, https://bugzilla.suse.com/1130496, https://bugzilla.suse.com/1152736, https://www.suse.com/security/cve/CVE-2018-20482, https://www.suse.com/security/cve/CVE-2019-9923, https://bugzilla.suse.com/ECO-339