{"cves":["CVE-2025-45582","CVE-2026-18477","CVE-2026-18508","CVE-2026-5704"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[2:1.30-13]\n- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)\n- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)\n  Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).\n- Upstream fix for build with libacl 2.4.0\n- Backport upstream patches for CVE-2026-18477, fixes a bug\n  where incremental restore with cyclic renames between backups\n  may create a temporary directory at an archive-controlled path\n  outside the extraction tree.\n  The fix for CVE-2025-45582 already prevents exploiting\n  this problem, so it is more a correctness and hardening change.\n\n[2:1.30-12]\n- Backport upstream changes to jailify extraction directory\n  Includes related gnulib changes to add openat2\n  Fixes CVE-2025-45582","id":"ELSA-2026-70390","ovalId":"oval:com.oracle.elsa:def:202670390","source":"oracle_linux","title":"ELSA-2026-70390:  tar security, bug fix, and enhancement update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2026-70390.html"}