CVE-2007-4476
NoneCVSS
—
EPSS
14.9%
Published
Sep 5, 2007
CISA due date
—
The record
Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | cpio | 0 | 2.9-5 |
| Debian:10 | tar | 0 | 1.18-1 |
| Debian:11 | cpio | 0 | 2.9-5 |
| Debian:11 | tar | 0 | 1.18-1 |
| Debian:12 | cpio | 0 | 2.9-5 |
| Debian:12 | tar | 0 | 1.18-1 |
| Debian:13 | cpio | 0 | 2.9-5 |
| Debian:13 | tar | 0 | 1.18-1 |
| Debian:14 | cpio | 0 | 2.9-5 |
| Debian:14 | tar | 0 | 1.18-1 |
| Debian:3.1 | tar | 0 | 1.14-2.4 |
| Debian:4.0 | cpio | 0 | 2.6-18.1+etch1 |
| Debian:4.0 | tar | 0 | 1.16-2etch1 |
| Red Hat:enterprise_linux:4::as | tar | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:4::as | tar-debuginfo | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:4::desktop | tar | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:4::desktop | tar-debuginfo | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:4::es | tar | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:4::es | tar-debuginfo | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:4::ws | tar | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:4::ws | tar-debuginfo | 0 | 0:1.14-13.el4_8.1 |
| Red Hat:enterprise_linux:5::client | cpio | 0 | 0:2.6-23.el5_4.1 |
| Red Hat:enterprise_linux:5::client | cpio-debuginfo | 0 | 0:2.6-23.el5_4.1 |
| Red Hat:enterprise_linux:5::client | tar | 0 | 2:1.15.1-23.0.1.el5_4.2 |
| Red Hat:enterprise_linux:5::client | tar-debuginfo | 0 | 2:1.15.1-23.0.1.el5_4.2 |
| Red Hat:enterprise_linux:5::server | cpio | 0 | 0:2.6-23.el5_4.1 |
| Red Hat:enterprise_linux:5::server | cpio-debuginfo | 0 | 0:2.6-23.el5_4.1 |
| Red Hat:enterprise_linux:5::server | tar | 0 | 2:1.15.1-23.0.1.el5_4.2 |
| Red Hat:enterprise_linux:5::server | tar-debuginfo | 0 | 2:1.15.1-23.0.1.el5_4.2 |
Related vulnerabilities
- CVE-2015-1197 cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to… Also affects cpio
- CVE-2010-0624 Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client… Also affects cpio
- CVE-2023-39804 In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an… Also affects tar
- CVE-2006-6097 GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to… Also affects tar
- CVE-2023-7207 Debian's cpio contains a path traversal vulnerability. Also affects cpio
- CVE-2016-6321 Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14… Also affects tar
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119