TA
Product
Tar
20
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 7Low 1
Watch
Add Tar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9923 | 7.5 | Mar 22 | pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers Affected: before 1.32 |
| CVE-2016-6321 | 7.5 | Dec 9 | Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write… Affected: 1.14; 1.15; 1.15.1; 1.15.90; 1.15.91; 1.16; +15 more |
| CVE-2023-39804 | 6.2 | Mar 27 | In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c Affected: before 1.35 |
| CVE-2026-5704 | 5.5 | Apr 6 | Tar: tar: hidden file injection via crafted archives Affected: All versions, or not specified |
| CVE-2022-48303 | 5.5 | Jan 30 | GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump Affected: through 1.34 |
| CVE-2018-20482 | 4.7 | Dec 26 | GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in… Affected: through 1.30 |
| CVE-2026-18477 | 4.4 | Aug 3 | Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape Affected: 1.35 |
| CVE-2026-18508 | 4.4 | Aug 3 | Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite Affected: 1.35 |
| CVE-2025-45582 | 4.1 | Jul 11 | GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process Affected: before 1.35 |
| CVE-2021-20193 | 3.3 | Mar 26 | A flaw was found in the src/list.c of tar 1.33 and earlier Affected: through 1.33 |
| CVE-2010-0624 | – | Mar 15 | Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers… Affected: through 1.22; 1.13; 1.13.5; 1.13.11; 1.13.14; 1.13.16; +18 more |
| CVE-2007-4476 | – | Sep 5 | Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack." Affected: before 1.19 |
| CVE-2007-4131 | – | Aug 25 | Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain // Affected: 1.13; 1.13.5; 1.13.11; 1.13.14; 1.13.16; 1.13.17; +10 more |
| CVE-2006-6097 | – | Nov 24 | GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a… Affected: 1.15.1; 1.16 |
| CVE-2006-0300 | – | Feb 24 | Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors… Affected: 1.14; 1.14.1; 1.15; 1.15.1; 1.15.90 |
| CVE-2005-1918 | – | Dec 31 | The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted… Affected: 1.13.25 |
| CVE-2005-2541 | – | Aug 10 | Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges Affected: 1.15.1 |
| CVE-2002-1216 | – | Oct 28 | GNU tar 1.13.19 and other versions before 1.13.25 allows remote attackers to overwrite arbitrary files via a symlink attack, as the result of a modification that effectively… Affected: through 1.13.25; 1.13.19 |
| CVE-2002-0399 | – | Oct 10 | Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a… Affected: 1.13.25 |
| CVE-2001-1267 | – | Jul 12 | Directory traversal vulnerability in GNU tar 1.13.19 and earlier allows local users to overwrite arbitrary files during archive extraction via a tar file whose filenames contain a… Affected: through 1.13.19 |
Showing 20