5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
0.003 Low
EPSS
Percentile
71.2%
Debian Security Advisory DSA-2863-1 [email protected]
http://www.debian.org/security/ Luciano Bello
February 18, 2014 http://www.debian.org/security/faq
Package : libtar
Vulnerability : directory traversal
CVE ID : CVE-2013-4420
Debian Bug : 731860
A directory traversal attack was reported against libtar, a C library for
manipulating tar archives. The application does not validate the
filenames inside the tar archive, allowing to extract files in arbitrary
path. An attacker can craft a tar file to override files beyond the
tar_extract_glob and tar_extract_all prefix parameter.
For the oldstable distribution (squeeze), this problem has been fixed in
version 1.2.11-6+deb6u2.
For the stable distribution (wheezy), this problem has been fixed in
version 1.2.16-1+deb7u2.
For the unstable distribution (sid), this problem has been fixed in
version 1.2.20-2.
We recommend that you upgrade your libtar packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | sparc | libtar0 | < 1.2.16-1+deb7u2 | libtar0_1.2.16-1+deb7u2_sparc.deb |
Debian | 7 | mips | libtar-dev | < 1.2.16-1+deb7u2 | libtar-dev_1.2.16-1+deb7u2_mips.deb |
Debian | 6 | ia64 | libtar-dev | < 1.2.11-6+deb6u2 | libtar-dev_1.2.11-6+deb6u2_ia64.deb |
Debian | 7 | i386 | libtar0 | < 1.2.16-1+deb7u2 | libtar0_1.2.16-1+deb7u2_i386.deb |
Debian | 6 | s390 | libtar-dev | < 1.2.11-6+deb6u2 | libtar-dev_1.2.11-6+deb6u2_s390.deb |
Debian | 7 | s390 | libtar-dev | < 1.2.16-1+deb7u2 | libtar-dev_1.2.16-1+deb7u2_s390.deb |
Debian | 6 | armel | libtar-dev | < 1.2.11-6+deb6u2 | libtar-dev_1.2.11-6+deb6u2_armel.deb |
Debian | 6 | mipsel | libtar | < 1.2.11-6+deb6u2 | libtar_1.2.11-6+deb6u2_mipsel.deb |
Debian | 7 | all | libtar | < 1.2.16-1+deb7u2 | libtar_1.2.16-1+deb7u2_all.deb |
Debian | 7 | i386 | libtar-dev | < 1.2.16-1+deb7u2 | libtar-dev_1.2.16-1+deb7u2_i386.deb |