CVE-2007-6265

CVE-2007-6265 affects avast! 4 Home and Professional Editions prior to 4.7.1098. The vulnerability allows remote attackers to influence the system via a crafted TAR archive, with the impact described as unknown in the available sources. No exploitation details, affected subcomponents, or remediat...

Alwil Avast! antivirus memory corruption

4-byte overflow on TAR archive parsing...

[Full-disclosure] Avast! AntiVirus TAR Processing Remote Heap Corruption

Avast! AntiVirus TAR Processing Remote Heap Corruption Sowhat of Nevis Labs http://www.nevisnetworks.com http://secway.org/advisory/AD20071206.txt BID: 26702 Vendor: ALWIL Software Affected: Avast! Home/Professional 4.7.1098 This vulnerability has been confirmed on Avast! Professional 4.7.1043...

GNU TAR和CPIO safer_name_suffix远程拒绝服务漏洞

BUGTRAQ ID: 26445 CVECAN ID: CVE-2007-4476 GNU Tar和GNU Cpio都是流行的用于管理档案文件的程序。 tar和cpio使用的safernamesuffix函数使用alloca报告所要剥离的前缀字符串，而这个字符串的长度（也就是传送给alloca的大小）是受tarball所有者控制的。因此，只要字符串超长就可以触发栈溢出。由于alloca之后的memcpy调用，这个溢出只能导致崩溃 GNU cpio 2.6 GNU cpio 2.5 GNU cpio 2.4 GNU cpio 1.x GNU tar 1.16 GNU tar 1.15 G...

gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability

SecurityFocus reports: GNUs tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the alloca function. Successfully exploiting this issue allows attackers to crash the affected utilities and possibly to execute code but this has not been confirmed...

GNU TAR 1.15.91 CPIO 2.5.90 - safer_name_suffix Remote Denial of Service

GNU TAR 1.15.91 CPIO 2.5.90 - safernamesuffix Remote Denial of Service // source: https://www.securityfocus.com/bid/26445/info GNU's tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the 'alloca' function. Successfully exploiting this issue allows...

GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service

// source: https://www.securityfocus.com/bid/26445/info GNU's tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the 'alloca' function. Successfully exploiting this issue allows attackers to crash the affected utilities and possibly to execute code, b...

Ubuntu 6.06 LTS / 6.10 / 7.04 : tar vulnerability (USN-506-1)

Dmitry V. Levin discovered that tar did not correctly detect the '..' file path element when unpacking archives. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary files could be overwritten with user privileges. Note that Tenable Network Security...

Ubuntu 5.10 / 6.06 LTS / 6.10 : tar vulnerability (USN-385-1)

Teemu Salmela discovered that tar still handled the deprecated GNUTYPENAMES record type. This record type could be used to create symlinks that would be followed while unpacking a tar archive. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary fil...

Perl Archive::Tar模块远程目录遍历漏洞

BUGTRAQ ID: 26355 CVECAN ID: CVE-2007-4829 Archive::Tar是Perl中用于操控tar文档的模块。 Archive::Tar模块在解压tar文档时存在输入验证错误，如果所解压到文档中包含有目录遍历序列的话，就可以将文件解压到指定目录以外的任意位置。 CPAN Archive::Tar 1.36 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.cpan.org...

Fedora 8 : tar-1.17-4.fc8 (2007-2800)

Wed Oct 24 2007 Radek Brich 2:1.17-4 - upstream patch for CVE-2007-4476 tar stack crashing in safernamesuffix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as...

[SECURITY] Fedora 8 Update: tar-1.17-4.fc8

The GNU tar program saves many files together in one archive and can restore individual files or all of the files from that archive. Tar can also be used to add supplemental files to an archive and to update or list files in the archive. Tar includes multivolume support, automatic archive...

Fedora 7 : tar-1.15.1-28.fc7 (2007-2673)

Wed Oct 24 2007 Radek Brich 2:1.15.1-28 - backported upstream patch for CVE-2007-4476 tar stack crashing in safernamesuffix - Tue Aug 28 2007 Radek Brich 2:1.15.1-27 - fixed CVE-2007-4131 tar directory traversal vulnerability 253684 Note that Tenable Network Security has extracted the preceding...

Fedora Core 6 : tar-1.15.1-27.fc6 (2007-735)

Wed Oct 24 2007 Radek Brich 2:1.15.1-27 - backported upstream patch for CVE-2007-4476 tar stack crashing in safernamesuffix Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Fedora 7 : tar-1.15.1-27.fc7 (2007-1890)

Tue Aug 28 2007 Radek Brich 2:1.15.1-27 - fixed CVE-2007-4131 tar directory traversal vulnerability 253684 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as...

[SECURITY] Fedora Core 6 Update: cpio-2.6-22.fc6

GNU cpio copies files into or out of a cpio or tar archive. Archives are files which contain a collection of other files plus information about them, such as their file name, owner, timestamps, and access permissions. The archive can be another file on the disk, a magnetic tape, or a pipe. GNU cp...

[SECURITY] Fedora Core 6 Update: tar-1.15.1-27.fc6

The GNU tar program saves many files together in one archive and can restore individual files or all of the files from that archive. Tar can also be used to add supplemental files to an archive and to update or list files in the archive. Tar includes multivolume support, automatic archive...

Directory traversal

Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences...

CVE-2007-4829

Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences...

CVE-2007-4829

Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences...