CVE-2013-4420
Published Feb 20, 2014
Last updated 11 years ago
Overview
- Description
- Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Source
- secalert@redhat.com
- NVD status
- Analyzed
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5.8
- Impact score
- 4.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:N/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-22
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:feep:libtar:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7908BED9-25A3-4E8B-852D-EAC8D75745C2",
"versionEndIncluding": "1.2.20"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17D20697-E839-434B-A12A-6C09A8F2D79A"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB0B7CEF-1B95-4FC5-94A6-834488341AD6"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "15FDD28C-D035-4E76-BE44-E8191A487064"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10A64757-FC13-441A-9667-6222E1881B2E"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2161B141-7C5C-4FF6-B7E7-BF06580821BE"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFEFFA4F-EF13-4CF4-AA05-CDC6DA28A383"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E41D1E6-B7B3-4A0A-8F5A-A62BD3D6DBA8"
},
{
"criteria": "cpe:2.3:a:feep:libtar:1.2.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4EC442B5-24F9-46FA-9998-87D550AC695A"
}
],
"operator": "OR"
}
]
}
]