Skip to content
OpenAdvisories
High USN-3132-1 1 CVE

tar vulnerability

Published Nov 21, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Harry Sintonen discovered that tar incorrectly handled extracting files
when path names are specified on the command line. If a user or automated
system were tricked into processing a specially crafted archive, an
attacker could possibly overwrite arbitrary files.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS tar 1.27.1-1ubuntu0.1
Ubuntu · 16.04 LTS 16.04:LTS tar 1.28-2.1ubuntu0.1

Vulnerabilities 1

  • High 7.5
    CVE-2016-6321 EPSS 16%

    Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote att…

    tar tar tar Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2016-6321