libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap out-of-bounds read)

As cited

Copy frozen at 2026-11-04 17:44 UTC (site build).

vulnerabilities

libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap out-of-bounds read)

A researcher discovered that libtar's previous fix for CVE-2021-33643 and CVE-2021-33644 does not fully address the heap out-of-bounds read vulnerability; a malicious tar archive can still trigger the defect even in patched distributions like Debian 12. The project appears abandoned, and a new CVE identifier is pending assignment from MITRE.

Why it matters: Organizations and distributions packaging libtar need to await the new CVE and assess whether their current patches are sufficient, as the original fix was incomplete and the project has no active maintainers.

Source published

2026-11-04 16:17 UTC

First seen by Cybersecurity Tracker

2026-11-04 17:14 UTC