{"id":"CVE-2021-33643","state":"PUBLISHED","title":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds r","description":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.","publishedAt":"2022-08-09T00:00:00.000Z","updatedAt":"2026-06-23T14:42:04.986Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","source":"CISA-ADP"},"assigner":"openEuler","products":["n/a libtar"],"affected":[{"vendor":"n/a","product":"libtar","versions":[{"version":"<1.2.21","status":"affected"}]}],"references":["https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/","https://lists.debian.org/debian-lts-announce/2025/01/msg00026.html"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T19:48:36.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/33xxx/CVE-2021-33643.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-33643","state":"PUBLISHED","datePublished":"2022-08-09T00:00:00.000Z","dateUpdated":"2026-06-23T14:42:04.986Z","assignerShortName":"openEuler","assignerOrgId":"7e1ac599-2767-43fa-b3ea-f10178cc98f2","dateReserved":"2021-05-28T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read."}],"affected":[{"vendor":"n/a","product":"libtar","versions":[{"version":"<1.2.21","status":"affected"}]}],"references":[{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/","name":"FEDORA-2022-fe1a4e3cf0","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC/","name":"FEDORA-2022-50e8a1b51d","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/","name":"FEDORA-2022-44a20bba43","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/","name":"FEDORA-2022-88772d0a2d","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/","name":"FEDORA-2022-ccc68b06cc","tags":["vendor-advisory"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","type":"CWE","lang":"en","description":"CWE-125: Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"openEuler","orgId":"7e1ac599-2767-43fa-b3ea-f10178cc98f2","dateUpdated":"2022-12-28T00:00:00.000Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/","name":"FEDORA-2022-fe1a4e3cf0","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC/","name":"FEDORA-2022-50e8a1b51d","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/","name":"FEDORA-2022-44a20bba43","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/","name":"FEDORA-2022-88772d0a2d","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/","name":"FEDORA-2022-ccc68b06cc","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00026.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:33:35.833Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-06-23T14:41:54.824443Z","id":"CVE-2021-33643","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-23T14:42:04.986Z"}}]}}}