CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

archivers/gtar1.35_1

GNU version of the traditional tape archiver

Maintainer
naddy@FreeBSD.org
Packages
gtar 1.35_1
Upstream
up to date
CPE
gnu:tar from the port
WWW
https://www.gnu.org/software/tar/
Links
cgit · VuXML

Unaddressed (2) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-184774.42026-08-03A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being ba…
CVE-2026-185084.42026-08-03A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may …

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (5)

Show 5 fixed
VuXML entries whose affected range this version has left.

Commits (127)

Christian Weisgerber (naddy) · 1.23_2
Fix dead loop on extracting existing symlinks with the -k option.

Submitted by:	John Hein <jhein@symmetricom.com>
Obtained from:	upstream
044cfb9a82
Ade Lovett (ade) · 1.23_1
Bounce PORTREVISION for gettext-related ports.  Have fun, ya'll.
8d837132c7
Christian Weisgerber (naddy) · 1.23
The xz utils and lzma library have been imported into base, so make the dependency on the archivers/xz port conditional on OSVERSION.
26e0343990
Christian Weisgerber (naddy) · 1.23
Update to 1.23: miscellaneous bug fixes and minor additions.
2d640b7c88
Christian Weisgerber (naddy) · 1.22_3
Fix a buffer overflow in the rmt client functionality. From upstream.

Security:	c175d72f-3773-11df-8bb8-0211d880e350
0f7ef19845
Christian Weisgerber (naddy) · 1.22_2
Fix a geline() segfault on 8.0 when using --listed-incremental.

Submitted by:	Dennis Noordsij <noordsij@cs.helsinki.fi>
79534bfe7b
Christian Weisgerber (naddy) · 1.22_1
You can now use -J to (un)compress xz format files (.tar.xz, .txz).

Feature safe:	yes
5e595dd9e6
Christian Weisgerber (naddy) · 1.22
Mark MAKE_JOBS_SAFE for SMP compilation.

PR:		133014
Submitted by:	mm
ecb256f779
Christian Weisgerber (naddy) · 1.22
Update to 1.22 which adds --xz/-J support for xz compression. However, xz itself does not have a stable release yet, so don't force a runtime dependency.
e96f16b2ee
Christian Weisgerber (naddy) · 1.21
* Update to 1.21.  Notable changes:   - Some new flags, e.g. -J for lzma compression and --lzop.   - transformation scope flags   Testsuite fixes from upstream CVS.

* Drop workarounds for no longer supported FreeBSD releases.
dbf64c8d6b
Ade Lovett (ade) · 1.20_1
Conversion from (now defunct) autoconf-2.61 to autoconf-2.62

Tested by:	exp build run (erwin)
771ea13f41
Christian Weisgerber (naddy) · 1.20_1
Rename manual "test" target to "regression-test" so that it will be automatically run on the package build cluster.

Suggested by Pedro <pfgshield-freebsd@yahoo.com>.
a3a71e00ee
Edwin Groothuis (edwin) · 1.20_1
Bump portrevision due to upgrade of devel/gettext.

The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).

PR:             ports/124340
Submitted by:   edwin@
Approved by:    portmgr (pav)
6527ef2070
Christian Weisgerber (naddy) · 1.20
- Revert previous workaround, 8.0-CURRENT has grown fdopendir(3).

- Update to 1.20.
  Notable changes: This release adds support for lzma compression
  and the -a option to select the compression algorithm based on
  the suffix of the archive file name.
c469d2a6c1
Christian Weisgerber (naddy) · 1.19
Work around the assumption that openat() implies the existence of fdopendir().  FreeBSD 8 has the former, but not the latter.

PR:		122433
cc18c45c56
Christian Weisgerber (naddy) · 1.19
Update to 1.19.  Changes in this releases: * new option --exclude-vcs * miscellaneous bug fixes
85ec89441c
Christian Weisgerber (naddy) · 1.18_1
Fix directory traversal vulnerability.

PR:		115914
Submitted by:	Nick Barkas <snb@threerings.net>
Security:	http://www.vuxml.org/freebsd/d944719e-42f4-4864-89ed-f045b541919f.html
89a513d4c6
Christian Weisgerber (naddy) · 1.18
Update to 1.18.  Switched to GPLv3, no user visible changes.

PR:		115548
Submitted by:	rafan
dd1ed9f0e1
Rong-En Fan (rafan) · 1.17_1
- Set --mandir and --infodir in CONFIGURE_ARGS if the configure script   supports them.  This is determined by running ``configure --help'' in   do-configure target and set the shell variable _LATE_CONFIGURE_ARGS   which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable   Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - 

PR:		ports/111470
Approved by:	portmgr
Discussed with:	stas (Mk/*), gerald (info related stuffs)
Tested by:	pointyhat exp run
f935a609c5
Christian Weisgerber (naddy) · 1.17_1
Fix message catalog directories.

Submitted by:	kris	(pointyhat)
b579519222
Christian Weisgerber (naddy) · 1.17
Update to 1.17.  Changes in this release: * Fix archivation of sparse files in posix mode. * Fix operation of --verify --listed-incremental. * Fix --occurrence. * Scope of --transform and --strip-components options. * End-of-volume script can send the new volume name to tar.
922b3a074b
Christian Weisgerber (naddy) · 1.16.1
Update to 1.16.1.  User-visible changes: * New option --exclude-tag allows to specify "exclusion tag files". * The --exclude-cache option now excludes the directories themselves, too. * Support for reading ustar type 'N' logical records has been removed. * Race conditions around 'tar -x --same-owner' have been fixed.
786c2a4e96
Christian Weisgerber (naddy) · 1.16_2
Fix GNUTYPE_NAMES directory traversal vulnerability by not extracting these entries.  Support for GNUTYPE_NAMES will be dropped completely in 1.16.1.

Notified by sem@

Security:	VuXML 3dd7eb58-80ae-11db-b4ec-000854d03344
521d9e0ead
Tom McLaughlin (tmclaugh) · 1.16_1
dirrmtry some directories which will be leftover on deinstall.

Notified by:	My tinderbox
8a50586c6f
Christian Weisgerber (naddy) · 1.16
Update to 1.16.  User-visible changes:

Incompatible changes:
* No globbing by default when extracting from or listing an archive.
* -l is now an alias of --check-links

Miscellaneous new options and bug fixes.  For a complete list, see
http://lists.gnu.org/archive/html/bug-tar/2006-10/msg00031.html
ab615e2700
Christian Weisgerber (naddy) · 1.15.1_2
Fix build on 4.x.

PR:		94084
Submitted by:	Tod McQuillin <devin@spamcop.net>
7ac31b1057
Christian Weisgerber (naddy) · 1.15.1_2
Fix a buffer overflow, caused by improper bounds checking of the PAX extended headers.  By tricking a user into processing a specially crafted tar archive, this could be exploited to execute arbitrary code with the privileges of the user.

Security:	CVE-2006-0300
Approved by:	portmgr (erwin)
Obtained from:	Ubuntu
bf7d710a9b
Edwin Groothuis (edwin) · 1.15.1_1
SHA256ify

Approved by:	krion@
ba5e62bd93
Christian Weisgerber (naddy) · 1.15.1_1
Fix command line parsing.

Submitted by:	Jiri Pridal <jiri.pridal@jmk.izscr.cz>
Obtained from:	GNU CVS
de2f97f40e
Christian Weisgerber (naddy) · 1.15.1
Update to 1.15.1.  Notable changes: - Compressed archives are now recognized automatically. - Numerous bug fixes.

Add a target "test" to run the included regression test suite.
5147d2a54e
Kirill Ponomarev (krion) · 1.14
Remove USE_GETTEXT
7113db1204
Kirill Ponomarev (krion) · 1.14
Support WITHOUT_NLS
85658cd493
Christian Weisgerber (naddy) · 1.14
Update to 1.14, the first new official release in almost five years. No user-visible changes from the last alpha version.
f5f4910246
Christian Weisgerber (naddy) · 1.13.94
Update to 1.13.94 and jettison private FreeBSD modifications.

Notable changes in this release:
- Support for POSIX.1-2001 and ustar archive formats.
- Various option flag changes.
- New message translations.
- Bug fixes.
9124180718
Trevor Johnson (trevor) · 1.13.25_8
Add size data, approved by maintainers.
38069212cc
Joe Marcus Clarke (marcus) · 1.13.25_8
Add USE_GETTEXT and bump PORTREVISION.

Submitted by:	trevor
Tested by:	bento
186b8ba82f
Trevor Johnson (trevor) · 1.13.25_7
Now gettext 0.12.1 is gettext-old.
78da40aa98
Ying-Chieh Liao (ijliao) · 1.13.25_7
introduce MASTER_SITE_GNU_ALPHA
d5126fe5f3
Joe Marcus Clarke (marcus) · 1.13.25_7
Bump the PORTREVISION for the ports directly affected by the gettext upgrade.

Prodded by:	kris
a3108b1e51
Joe Marcus Clarke (marcus) · 1.13.25_6
Chase the libintl.so shared lib version.
adccc29aad
Kris Kennaway (kris) · 1.13.25_6
Utilize INFO and bump PORTREVISION.
218656ddba
Christian Weisgerber (naddy) · 1.13.25_5
IGNORE while this is identical to the base system tar.

Suggested by:	kuriyama
19091648b6
Christian Weisgerber (naddy) · 1.13.25_5
pkg-comment -> COMMENT
32b8021ea5
Edwin Groothuis (edwin) · 1.13.25_5
Removed stale master_site, informed maintainer. Noticed by: portsurvey.
10b126ee47
Kris Kennaway (kris) · 1.13.25_5
Fix a security bug that allows extracted filenames to contain ".." and bump PORTREVISION.

Submitted by:	naddy
80b34183f1
Ade Lovett (ade) · 1.13.25_4
Chase shlib rev of devel/gettext

Submitted by:	lots and lots
Pointy hat to:	ade
c8eaa93644
Maxim Sobolev (sobomax) · 1.13.25_4
Sync with src/contrib/tar - re-enable --same-owner for uid 0.
808f5a34a8
Maxim Sobolev (sobomax) · 1.13.25_3
Sync with src/contrib/tar - don't assume that user with uid 0 doesn't really care about umask(2).
c4059919e6
Maxim Sobolev (sobomax) · 1.13.25_2
Unbroke on systems without <langinfo.h>.

PR:		38891
Submitted by:	Lev Serebryakov <lev@serebryakov.spb.ru>
0c04e664de
Maxim Sobolev (sobomax) · 1.13.25_2
Stage 1 of system GNU tar upgrade to a modern version:

Merge all applicable bugfixes, local hacks and new features from the ancient
base system tar into the port, so those two are interchangeable.

Bump PORTREVISION.
5942db774f