https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-30577.htmlhttps://patchthecve.com/cve/CVE-2023-30577.htmlWed, 17 Jun 2026 05:55:03 +0000HIGH 7.8: AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705.https://patchthecve.com/cve/CVE-2022-37705.htmlhttps://patchthecve.com/cve/CVE-2022-37705.htmlWed, 17 Jun 2026 04:55:11 +0000MEDIUM 6.7: A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the argumentshttps://patchthecve.com/cve/CVE-2022-37704.htmlhttps://patchthecve.com/cve/CVE-2022-37704.htmlWed, 17 Jun 2026 04:55:10 +0000MEDIUM 6.7: Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.https://patchthecve.com/cve/CVE-2022-37703.htmlhttps://patchthecve.com/cve/CVE-2022-37703.htmlWed, 17 Jun 2026 04:55:10 +0000LOW 3.3: In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbi