{"cves":["CVE-2026-18477","CVE-2026-18508","CVE-2026-5704"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[2:1.34-13]\n- Backport upstream patches for CVE-2026-18477, fixes a bug\n  where incremental restore with cyclic renames between backups\n  may create a temporary directory at an archive-controlled path\n  outside the extraction tree.\n  The fix for CVE-2025-45582 already prevents exploiting\n  this problem, so it is more a correctness and hardening change.\n\n[2:1.34-12]\n- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)\n- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)\n  Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).\n- Upstream fix for build with libacl 2.4.0","id":"ELSA-2026-61581-0","ovalId":"oval:com.oracle.elsa:def:2026615810","source":"oracle_linux","title":"ELSA-2026-61581-0:  tar security, bug fix, and enhancement update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2026-61581-0.html"}