SUSE CVE-2007-4134

Directory traversal vulnerability in extract.c in star before 1.5a84 allows user-assisted remote attackers to overwrite arbitrary files via certain //.. slash slash dot dot sequences in directory symlinks in a TAR archive...

CVE-2004-0850

Star before 1.5alpha46 does not drop the effective user ID euid before calling external programs, which could allow local users to gain privileges by modifying the RSH environment variable to reference a malicious program...