Unscored severity · published Aug 10, 2005
CVE-2005-2541
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges
–
CVSS
4%
EPSS
No
On KEV
Description
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Tar · Gnu
1.15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2541
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2541
marc.info
http://marc.info/?l=bugtraq&m=112327628230258&w=2
lists.apache.org
https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E
More from Tar
7.5
CVE-2019-9923
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers
7.5
CVE-2016-6321
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write…
6.2
CVE-2023-39804
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c
5.5
CVE-2026-5704
Tar: tar: hidden file injection via crafted archives
5.5
CVE-2022-48303
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump