Threats tagged 'ghsa-h2jx-m6c2-wg9q'

A vulnerability in BusyBox's tar utility allows improper resolution of deferred hardlink targets through symbolic links pointing outside the intended extraction directory. This flaw can be exploited by an attacker providing a specially crafted archive to overwrite arbitrary files on the system during extraction. The issue requires local user interaction and high attack complexity, limiting exposure primarily to constrained environments using BusyBox for extraction. Red Hat notes minimal exposure in common deployments and currently has no mitigation or fix meeting their criteria.