Posted by nick on Nov 04 Hello, libtar's fix for CVE-2021-33643 and CVE-2021-33644 is incomplete. A crafted tar archive can still cause a heap out-of-bounds read, including on distro builds that carry that fix (confirmed on Debian 1.2.20-8+deb12u1). libtar appears to be unmaintained. I reported this to the Debian security team on 2026-11-02, and they cleared it for publication on 2026-11-03.
libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap out-of-bounds read)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/515
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
Posted by Jan Schaumann on Nov 04 This Debian Security Advisory for CVE-2026-109518 in apt(1) seems worth sharing more widely…
Backporting security fixes at scale with Codex
Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting…
Backporting security fixes to stable releases
The software you are running is almost certainly riddled with known, unfixed security bugs. These bugs can be trivially and quickly exploited by modern AI agents. This…
Fwd: Go 1.27.4 and Go 1.26.11 pre-announcement
Posted by Alan Coopersmith on Nov 05 Forwarded Message Subject: [security] Go 1.27.4 and Go 1.26.11 pre-announcement Date: Thu, 5 Nov 2026 22:10:14 +0000 From: announce…
Re: CPython sandbox escape
Posted by Sam James on Nov 05 Alan Coopersmith writes: https://lwn.net/Articles/574215/ sam
zlib 1.4 released with security fixes
Posted by Alan Coopersmith on Nov 05 https://github.com/madler/zlib/releases/tag/v1.4 lists these security fixes: