[CLSA-2023:1677784249] Fix CVE(s): CVE-2022-48303, CVE-2021-20193

Type:

security

Severity:

Important

Release date:

2023-03-02 19:10:49 UTC

Description:

   * SECURITY UPDATE: memory leak in read_header
     - debian/patches/CVE-2021-20193.patch: Don't return directly
       from the loop. Instead set the status and break.  Return the
       status.
     - CVE-2021-20193.patch
   * SECURITY UPDATE: a heap buffer overflow
     - debian/patches/CVE-2022-48303.patch: Check for the end of
       field after leading byte (0x80 or 0xff) of base-256 encoded
       header value.
     - CVE-2022-48303.patch
   * improve debian/rules to build the project by root

Updated packages:

tar_1.28-2.1ubuntu0.2+tuxcare.els1_amd64.deb
sha:81a1ad7a69d85bcc49ac67ab9f506592bd86c8c1
tar-scripts_1.28-2.1ubuntu0.2+tuxcare.els1_amd64.deb
sha:7d04a9f7349527cf92b35b433076117e9fe113ff

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.