CVE-2018-20482: Debian Linux

Medium severity, CVSS 4.7. EPSS: 0.5% chance of exploitation in the next 30 days.

GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• GNU Tar: up to and including 1.30
• Opensuse Leap: version 15.0 only

Published 2018-12-26. Last modified 2026-06-17.