CVSS: 7.5EPSS: 2%CPEs: 13EXPL: 0CVE-2005-1918 – tar archive path traversal issue
https://notcve.org/view.php?id=CVE-2005-1918
31 Dec 2005 — The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/". • ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 0CVE-2005-2541
https://notcve.org/view.php?id=CVE-2005-2541
10 Aug 2005 — Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges. • http://marc.info/?l=bugtraq&m=112327628230258&w=2 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2002-1216
https://notcve.org/view.php?id=CVE-2002-1216
21 Oct 2002 — GNU tar 1.13.19 and other versions before 1.13.25 allows remote attackers to overwrite arbitrary files via a symlink attack, as the result of a modification that effectively disabled the security check. GNU tar 1.13.19 y otras versiones anteriores a 1.13.25 permite a atacantes remotos sobreescribir ficheros arbitrarios mediante un ataque de enlaces simbólicos (symlink), como resultado de una modificación que tiene como efecto desactivar la comprobación de seguridad. • http://marc.info/?l=bugtraq&m=103419290219680&w=2 •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2002-0399
https://notcve.org/view.php?id=CVE-2002-0399
01 Oct 2002 — Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267. Vulnerabilidad desconocida en GNU tar 1.13.25 permite a atacantes sobreescribir ficheros arbitrarios durante la extracción de archivos usando un ataque similar al identificado como CAN-2001-1269. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000538 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2001-1267
https://notcve.org/view.php?id=CVE-2001-1267
12 Jul 2001 — Directory traversal vulnerability in GNU tar 1.13.19 and earlier allows local users to overwrite arbitrary files during archive extraction via a tar file whose filenames contain a .. (dot dot). • ftp://alpha.gnu.org/gnu/tar/tar-1.13.25.tar.gz •