Debian Security Advisory 1438-1 - Several vulnerabilities have been discovered in GNU Tar. A directory traversal vulnerability enables attackers using specially crafted archives to extract contents outside the directory tree created by tar. A stack-based buffer overflow in the file name checking code may lead to arbitrary code execution when processing maliciously crafted archives.
cdb091cdc7a22e2e70fc77812d2d98bb673e8958c2eb906c42c3d283d52a525eFreeBSD Security Advisory - Insufficient sanity checking of paths containing '.' and '..' allows gtar to overwrite arbitrary files on the system.
dcc19ef1a758f3087be980a876f9e362719306f374c5862dbc64840fe61c16acGentoo Linux Security Advisory GLSA 200709-09 - Dmitry V. Levin discovered a directory traversal vulnerability in the contains_dot_dot() function in file src/names.c. Versions less than 1.18-r2 are affected.
b8e752fcba39278680d125f89cbfaa590d77d56976332487c361a209614c28a1Mandriva Linux Security Advisory - Dmitry V. Levin discovered a path traversal flaw in how GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary fiels that the user running tar has write access to.
a686299c7ad69af599405065a9fab46b18a1b9f6222ea2f6ef418008486957c6Ubuntu Security Notice 506-1 - Dmitry V. Levin discovered that tar did not correctly detect the ".." file path element when unpacking archives. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary files could be overwritten with user privileges.
868c0f350de5b4d960f77c146c0e2ec1baa6f2d02c50b7efa5fd193b353ecbe1
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed