oss-sec mailing list archives

Re: GNU tar: listing/extraction desynchronization allows hidden file injection


From: Paul Eggert <eggert () cs ucla edu>
Date: Sun, 12 Apr 2026 09:14:20 -0700

On 2026-04-11 21:10, Collin Funk wrote:
I didn't look much at the others since I am not very familiar with tar.
Hopefully Paul can quickly tell if they are bogus or not.

Yes, it's on my list of things to look at. As Collin hinted, much of that bug report is AI slop and this is why it's low priority for me.


Current thread: