Cyber ·
libtar: incomplete fix for CVE-2021-33643 and CVE-2021-33644 still allows heap out-of-bounds read
Advisory relayed on the oss-sec feed on 4 November 2026 reports that the libtar fix for CVE-2021-33643 and CVE-2021-33644 is incomplete: a crafted tar file can still trigger a heap out-of-bounds read, including in a Debian 12 build that already carries the fix.
Fact: the libtar fix for CVE-2021-33643 and CVE-2021-33644 is incomplete. According to the message reproduced on the oss-sec feed, a specially crafted tar file can still cause a heap out-of-bounds read, including in distribution builds that already include that fix. The case was confirmed on Debian with version 1.2.20-8+deb12u1.
Reported timeline: the author notified the Debian security team on 2 November 2026, and the team authorized publication on 3 November. A CVE ID has been requested from MITRE and is pending. The author also states that libtar appears to be unmaintained. The details section is truncated in the archived text, so the technical steps are not reproduced here.
Relevance: Rota Nacional does not patch third-party libraries and offers no specific protection against this flaw. Check whether libtar is present in systems and images, follow your distribution's advisory, and consider replacing unmaintained components. Wait for the CVE assignment and the official bulletin before drawing conclusions about impact and affected versions.
To consult and verify: open the original advisory indicated in the source, compare it with your distribution's security tracker, and confirm the installed version. Do not paste files or output from internal systems into AI tools to study this flaw.