Ubuntu alert USN-8510-1 (tar)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8510-1] tar vulnerability
Date:
             
 
Mon, 06 Jul 2026 13:38:19 +0000
Message-ID:
             
 
<E1wgjWd-0005DT-OA@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8510-1
July 06, 2026

tar vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

tar could be made to overwrite files.

Software Description:
- tar: GNU tar archive utility

Details:

It was discovered that tar incorrectly handled symlinks when extracting
archives. An attacker could possibly use this issue to overwrite arbitrary
files.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  tar                             1.35+dfsg-4ubuntu0.2

Ubuntu 24.04 LTS
  tar                             1.35+dfsg-3ubuntu0.2

Ubuntu 22.04 LTS
  tar                             1.34+dfsg-1ubuntu0.1.22.04.4

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8510-1
  CVE-2025-45582

Package Information:
  https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-4ubunt...
  https://launchpad.net/ubuntu/+source/tar/1.35+dfsg-3ubunt...
  https://launchpad.net/ubuntu/+source/tar/1.34+dfsg-1ubunt...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpLr4kACgkQcpJm3tlz
hgERFQ/+ITaj3krYGK3AfrIzmoSa/FWI4beYLTy7pQg7hv0lBK9PLvsdZ/Y+GZBm
wBZHkFWtIqyvxXBTQ4uQ5E8c2H1gCZtQK2teQr3o3EgvFRABIGR7XfU1DfQEdPtK
/og7LW9ztH3t9/Cx+yJNP1NiLRuI+uw1hb55OWlmUhlUir8/xWXT5P8mpPbi0eiX
miQ0T4gGZXUQ2HtDzI0Z3//5vkjHtI+wiJC4mSVTrDfrpJIwiApo6AgXBapr/LHv
f2MVBc+QCFL++yLG36JnLW6TGFbeqJtbvq5BvJacDQ7Q4RIXLDbwaYEfdKjYFlBZ
JKWVCdCSzvH+BZ9e+0mmLoyiipggdV4kYLOB0pf4XsTS0wJsfc/ol3K1LLcCHUUA
duoqyITX0HSHQ8SGy909zLbNUy3Zuc0sXxuGszkQUZTFUdgzE5X3opKGdTIrNeBX
91jnmHIg3naX32rbOyF8COFmrB+fUr7idw0g16G8Qoqg3FG/8Ln46L52UjDIziNh
WPWuzuuWfxTwZm0fuJdpHvkIKKf8I7YU6ItZ73H1ntYaI0WyJp1+1YJw+8+zhH+U
6EHqvcjVRzGlzo79vjf/g4Qugm6N0gxHUxFLFKtkKKgMdIHZ2RvS6YrzKYTqluAX
Isfpp8wqfLZLgehBh+ONaYqlgA0Nj30yuagLnCiPG8n1iKtBqp4=
=nl01
-----END PGP SIGNATURE-----