CVE-2002-0399

MEDIUM 5.0CVE-2002-0399 · Published 10/10/2002 · updated 16/06/2026

In short

CVE-2002-0399 is a MEDIUM (CVSS 5.0) vulnerability affecting tar (gnu).
Chance of exploitation in the next 30 days (EPSS): 3.6%, higher than 89.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
tar gnu	`= 1.13.25`	No fix yet

Description

Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.

References

distro.conectiva.com.br/atualizacoes
marc.info
secunia.com/advisories/19130
secunia.com/advisories/26604
secunia.com/advisories/26673
secunia.com/advisories/26987
sunsolve.sun.com/search/document.do
sunsolve.sun.com/search/document.do
iss.net/security_center/static/10224.php · Vendor Advisory
linuxsecurity.com/advisories/other_advisory-2400.html
mandriva.com/security/advisories
novell.com/linux/security/advisories/2006_05_sr.html
novell.com/linux/security/advisories/2007_19_sr.html
redhat.com/support/errata/RHSA-2002-096.html

More vulnerabilities in tar

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free