oss-sec mailing list archives
Re: GNU tar: listing/extraction desynchronization allows hidden file injection
From: Paul Eggert <eggert () cs ucla edu>
Date: Sun, 12 Apr 2026 09:14:20 -0700
On 2026-04-11 21:10, Collin Funk wrote:
I didn't look much at the others since I am not very familiar with tar. Hopefully Paul can quickly tell if they are bogus or not.
Yes, it's on my list of things to look at. As Collin hinted, much of that bug report is AI slop and this is why it's low priority for me.
Current thread:
- GNU tar: listing/extraction desynchronization allows hidden file injection Alan Coopersmith (Apr 11)
- Re: GNU tar: listing/extraction desynchronization allows hidden file injection Collin Funk (Apr 11)
- Re: GNU tar: listing/extraction desynchronization allows hidden file injection Alan Coopersmith (Apr 11)
- Re: GNU tar: listing/extraction desynchronization allows hidden file injection Solar Designer (Apr 11)
- Re: GNU tar: listing/extraction desynchronization allows hidden file injection Collin Funk (Apr 11)
- Re: GNU tar: listing/extraction desynchronization allows hidden file injection Paul Eggert (Apr 12)
- Re: GNU tar: listing/extraction desynchronization allows hidden file injection Collin Funk (Apr 11)
- Re: GNU tar: listing/extraction desynchronization allows hidden file injection Collin Funk (Apr 11)
