CVE-2007-4131
Fixed in a distro release EPSS 3%
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
Products: gnu tar
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | tar | 1.18-2 |
| Debian 13 | tar | 1.18-2 |
| Debian 14 | tar | 1.18-2 |
| Debian 3.1 | tar | 1.14-2.4 |
| Debian 4.0 | tar | 1.16-2etch1 |
| Red Hat Enterprise Linux 4 | tar | 0:1.14-12.5.1.RHEL4 |
| Red Hat Enterprise Linux 4 | tar-debuginfo | 0:1.14-12.5.1.RHEL4 |
| Red Hat Enterprise Linux 5 | tar | 2:1.15.1-23.0.1.el5 |
| Red Hat Enterprise Linux 5 | tar-debuginfo | 2:1.15.1-23.0.1.el5 |