VDB
CVE-2016-6321
CVE-2016-6321
PUBLISHED
CVSS 7.5 HIGH
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
EPSS 15.75% · 96.7th percentile
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
15.75%
96.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | tar | 0, 1.26+dfsg-8, 1.27.1-1 |
| Ubuntu:16.04:LTS | tar | 1.27.1-2, 1.28-2ubuntu1, 1.28-2.1 |
Timeline
- Oct 28, 2016 CVE Published
- Feb 4, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Feb 10, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 27, 2023 EPSS Score
- Sep 10, 2023 EPSS Score
- Dec 25, 2023 EPSS Score
- Feb 16, 2024 EPSS Score
- May 31, 2024 EPSS Score
References
- https://ubuntu.com/security/CVE-2016-6321 third-party-advisory
- https://sintonen.fi/advisories/tar-extract-pathname-bypass.txt third-party-advisory
- https://ubuntu.com/security/notices/USN-3132-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-6321 third-party-advisory