Description
Directory traversal vulnerability in GNU tar 1.13.19 and earlier allows local users to overwrite arbitrary files during archive extraction via a tar file whose filenames contain a .. (dot dot).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tar | 1.34-2.2 | openSUSE-SU-2024:11422-1 |
Advisories 1
- openSUSE-SU-2024:11422-1 tar-1.34-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 47800 vendor-advisory
- RHSA-2002:096 vendor-advisory
- 20010712 SECURITY.NNOV: directory traversal and path globing in multiple archivers mailing-list
- CLA-2002:538 vendor-advisory
- archive-extraction-directory-traversal(10224) vdb-entry
- RHSA-2002:138 vendor-advisory
- MDKSA-2002:066 vendor-advisory
- HPSBTL0209-068 vendor-advisory
- RHSA-2003:218 vendor-advisory
- 3024 vdb-entry