CVE Catalog
CVE-2021-33643
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk1.45%
70th percentile - higher than 70% of all known CVEs
Summary
An attacker who submits a crafted tar file with size in header struct being 0 may trigger a call to malloc(0) for the variable gnu_longlink, leading to an out-of-bounds read.
Risk Assessment
This vulnerability may lead to unauthorized memory access, posing a risk of data leakage or system crashes.
Recommendation
It is recommended to update the software to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.