Patchwire CVEs, their patch status, and feeds to follow them

CVE-2016-6321

Fixed in a distro release EPSS 16%CVSS 7.5

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

Published 2016-12-09 · CVE record · OSV

Products: gnu tar

Distro releases

ReleasePackageFixed in
Alpine 3.10tar1.29-r1
Alpine 3.11tar1.29-r1
Alpine 3.12tar1.29-r1
Alpine 3.13tar1.29-r1
Alpine 3.14tar1.29-r1
Alpine 3.15tar1.29-r1
Alpine 3.16tar1.29-r1
Alpine 3.17tar1.29-r1
Alpine 3.18tar1.29-r1
Alpine 3.19tar1.29-r1
Alpine 3.20tar1.29-r1
Alpine 3.21tar1.29-r1
Alpine 3.22tar1.29-r1
Alpine 3.23tar1.29-r1
Alpine 3.24tar1.29-r1
Alpine 3.4tar1.29-r1
Alpine 3.5tar1.29-r1
Alpine 3.6tar1.29-r1
Alpine 3.7tar1.29-r1
Alpine 3.8tar1.29-r1
Alpine 3.9tar1.29-r1
Arch Linuxtar1.29-2
Debian 12tar1.29b-1.1
Debian 13tar1.29b-1.1
Debian 14tar1.29b-1.1
Debian 7tar1.26+dfsg-0.1+deb7u1
Debian 8tar1.27.1-2+deb8u1
SUSE Linux Enterprise Desktop 12 SP1tar1.27.1-11.1
SUSE Linux Enterprise Desktop 12 SP2tar1.27.1-11.1
SUSE Linux Enterprise Server 11 SP4tar1.26-1.2.10.1
SUSE Linux Enterprise Server 12 SP1tar1.27.1-11.1
SUSE Linux Enterprise Server 12 SP2tar1.27.1-11.1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2tar1.27.1-11.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4tar1.26-1.2.10.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1tar1.27.1-11.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2tar1.27.1-11.1
Ubuntu 14.04 LTStar1.27.1-1ubuntu0.1
Ubuntu 16.04 LTStar1.28-2.1ubuntu0.1
openSUSE Tumbleweedtar1.29-2.1