CVEvulnerability

CVE-2016-6321

7.5 HIGH Published 2016-12-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-12-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-22

Description

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

Affected configurations

• gnu tar 1.14 • gnu tar 1.15 • gnu tar 1.15.1 • gnu tar 1.15.90 • gnu tar 1.15.91 • gnu tar 1.16 • gnu tar 1.16.1 • gnu tar 1.17 • gnu tar 1.18 • gnu tar 1.19 • gnu tar 1.20 • gnu tar 1.21 • gnu tar 1.22 • gnu tar 1.23 • gnu tar 1.24 • gnu tar 1.25 • gnu tar 1.26 • gnu tar 1.27 • gnu tar 1.27.1 • gnu tar 1.28 • gnu tar 1.29

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References