CVE-2013-4397
libtar: Heap-based buffer overflows by expanding a specially-crafted archive
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.
Múltiples desbordamientos de entero en la función the_read de lib/block.c en libtar anterior a 1.2.20 permite a atacantes remotos causar una dengación de servicio (crash) y posiblemente ejecuta código de forma arbitraria a través de un largo (1) nombre o (2) enlace en un archivo, lo que dispara un desbordamiento de buffer (heap)
The libtar package contains a C library for manipulating tar archives. The library supports both the strict POSIX tar format and many of the commonly used GNU extensions. Two heap-based buffer overflow flaws were found in the way libtar handled certain archives. If a user were tricked into expanding a specially-crafted archive, it could cause the libtar executable or an application using libtar to crash or, potentially, execute arbitrary code. Note: This issue only affected 32-bit builds of libtar.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-06-12 CVE Reserved
- 2013-10-10 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-189: Numeric Errors
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/10/10/4 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2013/10/10/6 | Mailing List |
|
| http://www.securityfocus.com/bid/62922 | Vdb Entry | |
| http://www.securitytracker.com/id/1029166 | Vdb Entry | |
| http://www.securitytracker.com/id/1040106 | Vdb Entry | |
| https://lists.feep.net:8080/pipermail/libtar/2013-October/000361.html | Mailing List | |
| https://source.android.com/security/bulletin/2018-01-01 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| http://repo.or.cz/w/libtar.git/commitdiff/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2013-1418.html | 2023-02-13 | |
| http://secunia.com/advisories/55188 | 2023-02-13 | |
| http://secunia.com/advisories/55253 | 2023-02-13 | |
| http://www.debian.org/security/2013/dsa-2817 | 2023-02-13 | |
| https://access.redhat.com/security/cve/CVE-2013-4397 | 2013-10-10 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1014492 | 2013-10-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | <= 1.2.19 Search vendor "Feep" for product "Libtar" and version " <= 1.2.19" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | 1.2.11 Search vendor "Feep" for product "Libtar" and version "1.2.11" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | 1.2.13 Search vendor "Feep" for product "Libtar" and version "1.2.13" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | 1.2.14 Search vendor "Feep" for product "Libtar" and version "1.2.14" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | 1.2.15 Search vendor "Feep" for product "Libtar" and version "1.2.15" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | 1.2.16 Search vendor "Feep" for product "Libtar" and version "1.2.16" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | 1.2.17 Search vendor "Feep" for product "Libtar" and version "1.2.17" | - |
Affected
| ||||||
| Feep Search vendor "Feep" | Libtar Search vendor "Feep" for product "Libtar" | 1.2.18 Search vendor "Feep" for product "Libtar" and version "1.2.18" | - |
Affected
| ||||||