CVE-2013-4420

NONE EPSS 86.9%
Published Feb 20, 201412y ago · Modified Jun 16, 20262w ago
Find Similar
Published Feb 20, 2014 12y ago
Last Modified Jun 16, 2026 2w ago

Description

Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.

Threat Intelligence

EPSS Exploit Probability
86.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 9

VendorProductVersionRange
feeplibtar* ≤1.2.20
feeplibtar1.2.11any
feeplibtar1.2.13any
feeplibtar1.2.14any
feeplibtar1.2.15any
feeplibtar1.2.16any
feeplibtar1.2.17any
feeplibtar1.2.18any
feeplibtar1.2.19any

References 3

  • debian.org http://www.debian.org/security/2014/dsa-2863
  • bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731860
  • lists.feep.net https://lists.feep.net:8080/pipermail/libtar/2014-February/000403.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.