CVE-2016-6321

CWE-22 — Path Traversal9 documents8 sources
Severity
7.5HIGH
EPSS
11.1%
top 6.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU TAR
Timeline
PublishedDec 9
Latest updateMay 13

Description

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Debiantar< 1.29b-1.1+3
▶NVDgnu/tar21 versions+20

Patches

Patch: git.savannah.gnu.org ↗Patch: seclists.org ↗Patch: git.savannah.gnu.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-4qpm-74c6-fg44: Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1↗2022-05-13
▶
OSV
CVE-2016-6321: Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1↗2016-12-09
▶
CVEList
CVE-2016-6321: Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1↗2016-12-09
▶

📋Vendor Advisories

3
Ubuntu
tar vulnerability↗2016-11-21
▶
Red Hat
tar: Bypassing the extract path name↗2016-10-27
▶
Debian
CVE-2016-6321: tar - Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-6321 tar: Bypassing the extract path name [fedora-27]↗2016-10-27
▶
Bugzilla
CVE-2016-6321 tar: Bypassing the extract path name↗2016-03-17
▶