The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2898 advisory.

    * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)

    * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)

    * libtar: memory leak found in th_read() function (CVE-2021-33645)

    * libtar: memory leak found in th_read() function (CVE-2021-33646)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libtar installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-33646 advisory.

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libtar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in     the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the     released memory is used (use-after-free). (CVE-2021-33640)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read. (CVE-2021-33643)

  - An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an     calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read. (CVE-2021-33644)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longlink after allocating memory, which may     cause a memory leak. (CVE-2021-33645)

  - The th_read() function doesn't free a variable t->th_buf.gnu_longname after allocating memory, which may     cause a memory leak. (CVE-2021-33646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libtar package has been released.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_2898 advisory.

    * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)

    * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)

    * libtar: memory leak found in th_read() function (CVE-2021-33645)

    * libtar: memory leak found in th_read() function (CVE-2021-33646)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0136 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2021-33640:
      After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in     the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the     released memory is used (use-after-free).
      CVE-2021-33645:
      A flaw was found in libtar. This security vulnerability occurs because the th_read() function in libtar     doesnt free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.

      CVE-2021-33646:
      A flaw was found in libtar. This security vulnerability occurs because the th_read() function in libtar     doesnt free a variable t->th_buf.gnu_longname after allocating memory, which may cause a memory leak.

      CVE-2021-33643:
      A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with the size in     the header struct being 0 to trigger a calling of malloc(0) for a variable gnu_longlink, causing an out-     of-bounds read.

      CVE-2021-33644:
      A flaw was found in libtar. This flaw allows an attacker who submits a crafted tar file with size in     header struct being 0 to trigger a calling of malloc(0) for a variable gnu_longname, causing an out-of-     bounds read.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5561:01 advisory.

    * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)
      * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)
      * libtar: memory leak found in th_read() function (CVE-2021-33645)
      * libtar: memory leak found in th_read() function (CVE-2021-33646)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
280096	RockyLinux 8 : libtar (RLSA-2023:2898)	Nessus	Rocky Linux Local Security Checks	2025/12/27	2025/12/27	critical
201693	CBL Mariner 2.0 Security Update: libtar (CVE-2021-33646)	Nessus	MarinerOS Local Security Checks	2024/7/3	2024/7/3	high
177207	EulerOS Virtualization 3.0.6.0 : libtar (EulerOS-SA-2023-2224)	Nessus	Huawei Local Security Checks	2023/6/13	2023/6/13	critical
204190	Photon OS 5.0: Libtar PHSA-2023-5.0-0010	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/10/13	critical
354100	Rocky Linux 8 [CIQ] Security Update: libtar / libtar-debuginfo / libtar-debugsource Multiple Vulnerabilities (crlsa-2023_2898)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
239260	TencentOS Server 3: libtar (TSSA-2023:0136)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
292931	MiracleLinux 8 : libtar-1.2.20-17.el8 (AXSA:2023-5561:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

検出

プラグインの検索

critical

high

critical

critical

critical

critical

critical