tar

Security advisories13

• tar: node-tar: Decompression/parse DoS via unlimited inputfixed in 7.5.19
• tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversalfixed in 7.5.7
• tar: Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extractionfixed in 7.5.8
• tar: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitizationfixed in 7.5.3
• tar: node-tar: Negative tar entry size causes infinite loop in archive replacefixed in 7.5.18
• tar: node-tar Symlink Path Traversal via Drive-Relative Linkpathfixed in 7.5.11
• tar: Denial of service while parsing a tar file due to lack of folders count validationfixed in 6.2.1
• tar: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsfixed in 7.5.17
• tar: tar has Hardlink Path Traversal via Drive-Relative Linkpathfixed in 7.5.10
• tar: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionfixed in 7.5.21
• tar: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSfixed in 7.5.4
• tar: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)fixed in 7.5.16
• tar: node-tar: Process crash via PAX numeric path type confusionfixed in 7.5.18

Versions that change something