Back Linuxsecurity Oracle Linux 9 Tar Moderate Bug Fix Advisory ELSA-2026-61581
Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×
[2:1.34-13] - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary directory at an archive-controlled path outside the extraction tree. The fix for CVE-2025-45582 already prevents exploiting this problem, so it is more a correctness and hardening change. [2:1.34-12] - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). - Upstream fix for build with libacl 2.4.0
[2:1.34-13] - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary directory at an archive-controlled path outside the extraction tree. The fix for CVE-2025-45582 already prevents exploiting this problem, so it is more a correctness and hardening change. [2:1.34-12] - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). - Upstream fix for build with libacl 2.4.0
tar-1.34-13.el9_8.x86_64.rpm
tar-1.34-13.el9_8.x86_64.rpm
tar-1.34-13.el9_8.aarch64.rpm
tar-1.34-13.el9_8.aarch64.rpm
Related CVEs: CVE-2026-5704 CVE-2026-18477 CVE-2026-18508
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
