Cloudanix VulnDB

CVE-2006-6097

None

CVSS

—

EPSS

11.7%

Published

Nov 24, 2006

CISA due date

—

The record

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 tar 0 1.16-2
Debian:11 tar 0 1.16-2
Debian:12 tar 0 1.16-2
Debian:13 tar 0 1.16-2
Debian:3.1 tar 0 1.14-2.3
Red Hat:enterprise_linux:2.1::as tar 0 0:1.13.25-6.AS21.1
Red Hat:enterprise_linux:2.1::aw tar 0 0:1.13.25-6.AS21.1
Red Hat:enterprise_linux:2.1::es tar 0 0:1.13.25-6.AS21.1
Red Hat:enterprise_linux:2.1::ws tar 0 0:1.13.25-6.AS21.1
Red Hat:enterprise_linux:3::as tar 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:3::as tar-debuginfo 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:3::desktop tar 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:3::desktop tar-debuginfo 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:3::es tar 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:3::es tar-debuginfo 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:3::ws tar 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:3::ws tar-debuginfo 0 0:1.13.25-15.RHEL3
Red Hat:enterprise_linux:4::as tar 0 0:1.14-12.RHEL4
Red Hat:enterprise_linux:4::as tar-debuginfo 0 0:1.14-12.RHEL4
Red Hat:enterprise_linux:4::desktop tar 0 0:1.14-12.RHEL4
Red Hat:enterprise_linux:4::desktop tar-debuginfo 0 0:1.14-12.RHEL4
Red Hat:enterprise_linux:4::es tar 0 0:1.14-12.RHEL4
Red Hat:enterprise_linux:4::es tar-debuginfo 0 0:1.14-12.RHEL4
Red Hat:enterprise_linux:4::ws tar 0 0:1.14-12.RHEL4
Red Hat:enterprise_linux:4::ws tar-debuginfo 0 0:1.14-12.RHEL4
openSUSE:Tumbleweed tar 0 1.34-2.2

Related vulnerabilities