Description
Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpio | 2.9-5 | — |
| Debian 14 | tar | 1.18-1 | — |
| Debian 13 | cpio | 2.9-5 | — |
| Debian 13 | tar | 1.18-1 | — |
| Debian 12 | cpio | 2.9-5 | — |
| Debian 12 | tar | 1.18-1 | — |
| Debian 4.0 | cpio | 2.6-18.1+etch1 | DSA-1566-1 |
| Debian 4.0 | tar | 1.16-2etch1 | DSA-1438-1 |
| Debian 3.1 | tar | 1.14-2.4 | DSA-1438-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cpio | 2.6-23.el5_4.1 | RHSA-2010:0144 |
| RHEL 5 | tar | 2:1.15.1-23.0.1.el5_4.2 | RHSA-2010:0141 |
| RHEL 4 | tar | 1.14-13.el4_8.1 | RHSA-2010:0141 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service EDB-30766 · dos · Nov 14, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2010:0144 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0141 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1438-1 tar Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1566-1 cpio - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1021680 vendor-advisory
- 27331 third-party-advisory
- 32051 third-party-advisory
- 29968 third-party-advisory
- SUSE-SR:2007:019 vendor-advisory
- 27681 third-party-advisory
- 26445 vdb-entry
- 27453 third-party-advisory
- FEDORA-2007-2673 vendor-advisory
- DSA-1566 vendor-advisory
- 27514 third-party-advisory
- oval:org.mitre.oval:def:8599 vdb-entry signature
- USN-709-1 vendor-advisory
- https://issues.rpath.com/browse/RPL-1861
- RHSA-2010:0144 vendor-advisory
- DSA-1438 vendor-advisory
- MDKSA-2007:233 vendor-advisory
- FEDORA-2007-735 vendor-advisory
- oval:org.mitre.oval:def:9336 vdb-entry signature
- 27857 third-party-advisory
- ADV-2010-0629 vdb-entry
- GLSA-200711-18 vendor-advisory
- MDKSA-2007:197 vendor-advisory
- 26987 third-party-advisory
- oval:org.mitre.oval:def:7114 vdb-entry signature
- SUSE-SR:2007:018 vendor-advisory
- ADV-2010-0628 vdb-entry
- RHSA-2010:0141 vendor-advisory
- 28255 third-party-advisory
- 33567 third-party-advisory
- 39008 third-party-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- USN-650-1 vendor-advisory
- 26674 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=280961
- http://bugs.gentoo.org/show_bug.cgi?id=196978