CVE-2016-6321

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection…

High · published December 9, 2016

CVSS v3.1

7.5

EPSS

16%

Percentile

96.8

In the wild

Unconfirmed

What it is

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.15745 · 96.8th percentile
Published: 2016-12-09T22:00Z

EPSS history

Timeline

09 DEC 22:00Z
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection…
cvelistv5