CVE-2016-6321

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gnu:tar:1.14:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.15:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.15.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.15.90:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.15.91:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.16:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.16.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.17:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.18:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.19:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.20:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.21:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.22:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.23:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.24:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.25:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.26:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.27:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.27.1:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.28:*:*:*:*:*:*:*
cpe:2.3:a:gnu:tar:1.29:*:*:*:*:*:*:*

History

13 Feb 2023, 04:50

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E', 'name': '[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8', 'tags': [], 'refsource': 'MLIST'}
  • (MISC) https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E -
  • (MISC) https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E -

29 Jun 2021, 15:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E -

Information

Published : 2016-12-09 22:59

Updated : 2023-12-10 12:01


NVD link : CVE-2016-6321

Mitre link : CVE-2016-6321

CVE.ORG link : CVE-2016-6321


JSON object : View

Products Affected

gnu

  • tar
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')