Timo Warns reported multiple integer overflow vulnerabilities in libtar, a library for manipulating tar archives, which can result in the execution of arbitrary code.

For the oldstable distribution (squeeze), this problem has been fixed in version 1.2.11-6+deb6u1. For the stable distribution (wheezy), this problem has been fixed in version 1.2.16-1+deb7u1. For the testing distribution (jessie), this problem has been fixed in version 1.2.20-1. For the unstable distribution (sid), this problem has been fixed in version 1.2.20-1. We recommend that you upgrade your libtar packages.

libtar allows programs to create, extract and test tar archives. It supports both the strict POSIX tar format and many of the commonly-used GNU extensions.

libtar on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2013/dsa-2817.html

---

Updated on 2015-03-25