elsa-2026-70390

oracle_linux
Description

[2:1.30-13] - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). - Upstream fix for build with libacl 2.4.0 - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary directory at an archive-controlled path outside the extraction tree. The fix for CVE-2025-45582 already prevents exploiting this problem, so it is more a correctness and hardening change. [2:1.30-12] - Backport upstream changes to jailify extraction directory Includes related gnulib changes to add openat2 Fixes CVE-2025-45582

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cves": [
    "CVE-2025-45582",
    "CVE-2026-18477",
    "CVE-2026-18508",
    "CVE-2026-5704"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[2:1.30-13]\n- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)\n- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)\n  Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).\n- Upstream fix for build with libacl 2.4.0\n- Backport upstream patches for CVE-2026-18477, fixes a bug\n  where incremental restore with cyclic renames between backups\n  may create a temporary directory at an archive-controlled path\n  outside the extraction tree.\n  The fix for CVE-2025-45582 already prevents exploiting\n  this problem, so it is more a correctness and hardening change.\n\n[2:1.30-12]\n- Backport upstream changes to jailify extraction directory\n  Includes related gnulib changes to add openat2\n  Fixes CVE-2025-45582",
  "id": "ELSA-2026-70390",
  "ovalId": "oval:com.oracle.elsa:def:202670390",
  "source": "oracle_linux",
  "title": "ELSA-2026-70390:  tar security, bug fix, and enhancement update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-70390.html"
}
View JSON API Download JSON