In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

Fix status by distribution

Fixed packages published by each distribution for this CVE

• Debian DEBIAN-CVE-2023-39804 tar Fixed in: 1.34+dfsg-1+deb11u1

References

• advisory github.com
• advisory nvd.nist.gov
• web bugs.debian.org
• web git.savannah.gnu.org
• web git.savannah.gnu.org
• web lists.debian.org