CVE-2019-9923
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Published Mar 22, 2019 · updated Oct 14, 2026 · gnu tar
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 22, 2019 · NIST NVD
Detected
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Oct 14, 2026 · NIST NVD
Updated
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Affected
- cpe gnu/tarversion unspecified
- cpe opensuse/leap15.0
Sources
- CVE.orgVulnerability recordCVE-2019-9923
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-9923
30-day exploitation probability 3.1%
first.org - NIST NVDVulnerability recordCVE-2019-9923
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
nvd.nist.gov