CVE

Id
93141  
CVE No.
CVE-2016-6321  
Status
Candidate  
Description
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.  
Phase
Assigned (20160726)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
792870 93141 CVE-2016-6321 FULLDISC:20161026 [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321)  View
792871 93141 CVE-2016-6321 URL:http://seclists.org/fulldisclosure/2016/Oct/96  View
792872 93141 CVE-2016-6321 FULLDISC:20161030 [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) - patch update  View
792873 93141 CVE-2016-6321 URL:http://seclists.org/fulldisclosure/2016/Oct/102  View
792874 93141 CVE-2016-6321 MLIST:[bug-tar] 20161029 Re: [Bug-tar] possible fixes for CVE-2016-6321  View
792875 93141 CVE-2016-6321 URL:http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html  View
792876 93141 CVE-2016-6321 MISC:http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html  View
792877 93141 CVE-2016-6321 MISC:https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt  View
792878 93141 CVE-2016-6321 CONFIRM:http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d  View
792879 93141 CVE-2016-6321 DEBIAN:DSA-3702  View
792880 93141 CVE-2016-6321 URL:http://www.debian.org/security/2016/dsa-3702  View
792881 93141 CVE-2016-6321 UBUNTU:USN-3132-1  View
792882 93141 CVE-2016-6321 URL:http://www.ubuntu.com/usn/USN-3132-1  View
792883 93141 CVE-2016-6321 BID:93937  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
3542 JVNDB-2016-004315 WordPress のネットワーク設定ページにおけるクロスサイトスクリプティングの脆弱性 WordPress のネットワーク設定ページには、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2016-6634 93141 4.3 6.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004315.html  View