ZeroDay Findings
Sign inSign up

Findings

CVE-2018-20482

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_

Published Dec 26, 2018 · updated Oct 14, 2026 · gnu tar

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

Timeline

Detection, updates, and resolution for this record.

  1. Dec 26, 2018 · NIST NVD

    Detected

    GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

  2. Oct 14, 2026 · NIST NVD

    Updated

    GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

  3. Oct 14, 2026 · OSV.dev

    Fix available

    tar fixed in 1.30+dfsg-3.1; tar fixed in 1.30+dfsg-3.1; tar fixed in 1.30+dfsg-3.1

  4. Oct 14, 2026 · OSV.dev

    Fix available

    tar fixed in 1.30+dfsg-3.1

  5. Oct 14, 2026 · OSV.dev

    Updated

    GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

Affected

  • Debian:12 tar0 → 1.30+dfsg-3.1
  • Debian:13 tar0 → 1.30+dfsg-3.1
  • Debian:14 tar0 → 1.30+dfsg-3.1
  • cpe debian/debian linux8.0
  • cpe debian/debian linux9.0
  • cpe gnu/tarversion unspecified
  • cpe opensuse/leap15.0

Sources

  • CVE.orgCVE-2018-20482

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-20482

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDCVE-2018-20482

    GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's proces

    nvd.nist.gov
  • OSV.devDEBIAN-CVE-2018-20482
    osv.dev

References

CVE-2018-20482 · ZeroDay Findings