Description:
The GNU tar program can save multiple files in an archive and restore files from an archive.
Security Fix(es):
* tar: tar: Hidden file injection via crafted archives (CVE-2026-5704)
* tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (CVE-2026-18477)
* tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVE-2026-18508)
Bug Fix(es) and Enhancement(s):
* tar: --one-top-level with absolute path fails [almalinux-9] (JIRA:AlmaLinux-144021)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
| Architecture |
Package |
Checksum |
| aarch64 |
tar-1.34-13.el9_8.aarch64.rpm |
f1e217efda9e83e55c704690ca95257873bbcd2de664111f0cce217bfe654034 |
| ppc64le |
tar-1.34-13.el9_8.ppc64le.rpm |
8e84e477ff22b515f04f7f4e9d5cb116f5d3d4a67878adcd306dc35df1df0cf6 |
| s390x |
tar-1.34-13.el9_8.s390x.rpm |
95eb7d8346985633d7dbd8542bd63ee87327823be2ce8111c0c41c3262fc0e1d |
| x86_64 |
tar-1.34-13.el9_8.x86_64.rpm |
2563f7bae97b6d73ded2af71250797ff30a3fe8050c70ac4b3126dbe32c0ce9e |
