Threats tagged 'ghsa-2v49-qr2f-xxxp'

unarr versions up to and including 1.1.1 contain an off-by-one heap-based buffer overflow vulnerability in the tar_get_name() function. This flaw can be triggered via the ar_entry_get_name() API by supplying a crafted TAR archive with a full ustar prefix and name, causing a NUL byte to be written past the allocated buffer, leading to heap corruption and potential process crash.