Vulnerability-Lookup

CVE-2022-48303 (GCVE-0-2022-48303)

Vulnerability from cvelistv5 – Published: 2023-01-30 00:00 – Updated: 2025-03-27 20:35

Summary

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-27 20:34 UTC

CWE

n/a
CWE-125 - Out-of-bounds Read

Assigner

mitre mitre root

References

4 references

URL	Tags
https://savannah.gnu.org/bugs/?62387
https://savannah.gnu.org/patch/?10307
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:10:59.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://savannah.gnu.org/bugs/?62387"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://savannah.gnu.org/patch/?10307"
          },
          {
            "name": "FEDORA-2023-123778d70d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/"
          },
          {
            "name": "FEDORA-2023-f72d3caf36",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-48303",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-27T20:34:11.069640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T20:35:03.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-26T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://savannah.gnu.org/bugs/?62387"
        },
        {
          "url": "https://savannah.gnu.org/patch/?10307"
        },
        {
          "name": "FEDORA-2023-123778d70d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/"
        },
        {
          "name": "FEDORA-2023-f72d3caf36",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-48303",
    "datePublished": "2023-01-30T00:00:00.000Z",
    "dateReserved": "2023-01-30T00:00:00.000Z",
    "dateUpdated": "2025-03-27T20:35:03.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48303",
      "date": "2026-09-14",
      "epss": "0.01476",
      "percentile": "0.72392"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:24:17.000Z",
      "cve": "CVE-2022-48303",
      "id": "msrc_CVE-2022-48303",
      "initial_release_date": "2023-01-04T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump",
      "url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2022-48303.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48303\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2023-01-30T04:15:08.030\",\"lastModified\":\"2026-06-17T05:14:57.703\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.\"},{\"lang\":\"es\",\"value\":\"GNU Tar hasta 1.34 tiene una lectura fuera de los l\u00edmites de un byte que resulta en el uso de memoria no inicializada para un salto condicional. No se ha demostrado explotaci\u00f3n para cambiar el flujo de control. El problema ocurre en from_header en list.c a trav\u00e9s de un archivo V7 en el que mtime tiene aproximadamente 11 caracteres de espacio en blanco.\"}],\"affected\":[{\"source\":\"cve@mitre.org\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-27T20:34:11.069640Z\",\"id\":\"CVE-2022-48303\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.34\",\"matchCriteriaId\":\"07E94814-967C-4B81-9137-6DA8E51F81D2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E30D0E6F-4AE8-4284-8716-991DFA48CC5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC559B26-5DFC-4B7A-A27C-B77DE755DFF9\"}]}]}],\"references\":[{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://savannah.gnu.org/bugs/?62387\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://savannah.gnu.org/patch/?10307\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://savannah.gnu.org/bugs/?62387\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://savannah.gnu.org/patch/?10307\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:38:24+00:00",
      "cve": "CVE-2022-48303",
      "id": "CVE-2022-48303",
      "initial_release_date": "2022-04-30T00:00:00+00:00",
      "product_status:fixed": "39",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "tar: heap buffer overflow at from_header() in list.c via specially crafted checksum",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48303.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://savannah.gnu.org/bugs/?62387\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://savannah.gnu.org/patch/?10307\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/\", \"name\": \"FEDORA-2023-123778d70d\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/\", \"name\": \"FEDORA-2023-f72d3caf36\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:10:59.656Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48303\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-27T20:34:11.069640Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-27T20:34:54.995Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://savannah.gnu.org/bugs/?62387\"}, {\"url\": \"https://savannah.gnu.org/patch/?10307\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CRY7VEL4AIG3GLIEVCTOXRZNSVYDYYUD/\", \"name\": \"FEDORA-2023-123778d70d\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5VQYCO52Z7GAVCLRYUITN7KXHLRZQS4/\", \"name\": \"FEDORA-2023-f72d3caf36\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2023-03-26T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48303\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-27T20:35:03.448Z\", \"dateReserved\": \"2023-01-30T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2023-01-30T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

SSA-806742

Vulnerability from csaf_siemens - Published: 2024-02-13 00:00 - Updated: 2024-02-13 00:00

Summary

SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4

Scope

160 vulnerabilities in this advisory, including CVE-2022-48303.

CVE-2022-48303

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Known affected: 11 products

https://support.industry.siemens.com/cs/ww/en/view/109826613/

Open the full advisory

SUSE-SU-2023:0441-1

Vulnerability from csaf_suse - Published: 2023-02-17 08:41 - Updated: 2023-02-17 08:41

Summary

Security update for tar

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2022-48303.

CVE-2022-48303

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 10 products

Open the full advisory

SUSE-SU-2023:0463-1

Vulnerability from csaf_suse - Published: 2023-02-20 15:33 - Updated: 2023-02-20 15:33

Summary

Security update for tar

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2022-48303.

CVE-2022-48303

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 40 products

Open the full advisory

ubuntu-cve-2022-48303

Vulnerability from osv_ubuntu

Published

2023-01-30 04:15

Modified

2025-09-08 16:50

Summary

Details

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-48303	REPORT
	https://savannah.gnu.org/bugs/?62387	REPORT
	https://savannah.gnu.org/patch/?10307	REPORT
	https://ubuntu.com/security/notices/USN-5900-1	ADVISORY
	https://ubuntu.com/security/notices/USN-5900-2	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2022-48303	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "tar",
            "binary_version": "1.27.1-1ubuntu0.1+esm3"
          },
          {
            "binary_name": "tar-scripts",
            "binary_version": "1.27.1-1ubuntu0.1+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "tar",
        "purl": "pkg:deb/ubuntu/tar@1.27.1-1ubuntu0.1+esm3?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.1-1ubuntu0.1+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.26+dfsg-8",
        "1.27-3",
        "1.27-4",
        "1.27.1-1",
        "1.27.1-1ubuntu0.1",
        "1.27.1-1ubuntu0.1+esm1",
        "1.27.1-1ubuntu0.1+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "tar",
            "binary_version": "1.28-2.1ubuntu0.2+esm2"
          },
          {
            "binary_name": "tar-scripts",
            "binary_version": "1.28-2.1ubuntu0.2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "tar",
        "purl": "pkg:deb/ubuntu/tar@1.28-2.1ubuntu0.2+esm2?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.28-2.1ubuntu0.2+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.27.1-2",
        "1.28-2ubuntu1",
        "1.28-2.1",
        "1.28-2.1ubuntu0.1",
        "1.28-2.1ubuntu0.2",
        "1.28-2.1ubuntu0.2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "tar",
            "binary_version": "1.29b-2ubuntu0.4"
          },
          {
            "binary_name": "tar-scripts",
            "binary_version": "1.29b-2ubuntu0.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "tar",
        "purl": "pkg:deb/ubuntu/tar@1.29b-2ubuntu0.4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.29b-2ubuntu0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.29b-2",
        "1.29b-2ubuntu0.1",
        "1.29b-2ubuntu0.2",
        "1.29b-2ubuntu0.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "tar",
            "binary_version": "1.30+dfsg-7ubuntu0.20.04.3"
          },
          {
            "binary_name": "tar-scripts",
            "binary_version": "1.30+dfsg-7ubuntu0.20.04.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "tar",
        "purl": "pkg:deb/ubuntu/tar@1.30+dfsg-7ubuntu0.20.04.3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30+dfsg-7ubuntu0.20.04.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.30+dfsg-6",
        "1.30+dfsg-7",
        "1.30+dfsg-7ubuntu0.20.04.1",
        "1.30+dfsg-7ubuntu0.20.04.2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "tar",
            "binary_version": "1.34+dfsg-1ubuntu0.1.22.04.1"
          },
          {
            "binary_name": "tar-scripts",
            "binary_version": "1.34+dfsg-1ubuntu0.1.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "tar",
        "purl": "pkg:deb/ubuntu/tar@1.34+dfsg-1ubuntu0.1.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.34+dfsg-1ubuntu0.1.22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.34+dfsg-1build1",
        "1.34+dfsg-1build2",
        "1.34+dfsg-1build3"
      ]
    }
  ],
  "aliases": [],
  "details": "GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.",
  "id": "UBUNTU-CVE-2022-48303",
  "modified": "2025-09-08T16:50:35Z",
  "published": "2023-01-30T04:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48303"
    },
    {
      "type": "REPORT",
      "url": "https://savannah.gnu.org/bugs/?62387"
    },
    {
      "type": "REPORT",
      "url": "https://savannah.gnu.org/patch/?10307"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5900-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-5900-2"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48303"
    }
  ],
  "related": [
    "USN-5900-1",
    "USN-5900-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-48303"
  ]
}

WID-SEC-W-2023-0213

Vulnerability from csaf_certbund - Published: 2023-01-29 23:00 - Updated: 2024-07-18 22:00

Summary

GNU tar: Schwachstelle ermöglicht nicht spezifizierten Angriff

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2022-48303.

CVE-2022-48303

Es existiert eine Schwachstelle in GNU tar. Diese beruht auf einem Ein-Byte-Out-of-Bounds-Read Problem, das zur Verwendung von nicht initialisiertem Speicher für einen bedingten Sprung führt. Ein Angreifer kann diese Schwachstelle ausnutzen, um nicht näher spezifizierte Auswirkungen zu verursachen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.

Known affected: 13 products Last affected: 1 product

Open the full advisory

WID-SEC-W-2023-1542

Vulnerability from csaf_certbund - Published: 2023-06-22 22:00 - Updated: 2025-11-18 23:00

Summary

Red Hat OpenShift: Mehrere Schwachstellen

Severity

Hoch

Scope

93 vulnerabilities in this advisory, including CVE-2022-48303.

CVE-2022-48303

Known affected: 19 products

Open the full advisory

WID-SEC-W-2023-2031

Vulnerability from csaf_certbund - Published: 2023-08-09 22:00 - Updated: 2025-10-19 22:00

Summary

Xerox FreeFlow Print Server: Mehrere Schwachstellen

Severity

Hoch

Scope

243 vulnerabilities in this advisory, including CVE-2022-48303.

CVE-2022-48303

Known affected: 6 products

Open the full advisory

WID-SEC-W-2023-2910

Vulnerability from csaf_certbund - Published: 2023-11-14 23:00 - Updated: 2023-11-14 23:00

Summary

Sophos Unified Threat Management (UTM) Software: Mehrere Schwachstellen

Severity

Mittel

Scope

3 vulnerabilities in this advisory, including CVE-2022-48303.

CVE-2022-48303

In Sophos Unified Threat Management (UTM) Software existieren mehrere Schwachstellen. Diese sind auf verschiedene Fehler im Kernprodukt sowie in Komponenten zurückzuführen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Open the full advisory

WID-SEC-W-2024-1307

Vulnerability from csaf_certbund - Published: 2024-06-06 22:00 - Updated: 2025-02-05 23:00

Summary

Red Hat OpenShift Service Mesh Containers: Mehrere Schwachstellen

Severity

Hoch

Scope

60 vulnerabilities in this advisory, including CVE-2022-48303.

CVE-2022-48303

In Red Hat OpenShift existieren mehrere Schwachstellen. Diese Fehler bestehen in verschiedenen Komponenten und Subsystemen wie der Libksba-Library, BIND, gmp und der Tar-Paketkomponente aufgrund einer Race Condition, einer NULL-Zeiger-Dereferenz, einem Speicherzuordnungsproblem und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um Dateien zu manipulieren, einen Denial of Service-Zustand erzuegen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder weitere nicht spezifizierte Angriffe durchzuführen.

Known affected: 7 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2022-48303 (GCVE-0-2022-48303)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature