CVE-2005-1918

LOW 2.6CVE-2005-1918 · Published 31/12/2005 · updated 16/06/2026

In short

CVE-2005-1918 is a LOW (CVSS 2.6) vulnerability affecting tar (gnu).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 87.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
tar gnu	`= 1.13.25`	No fix yet

Description

The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".

References

patches.sgi.com/support/free/security/advisories/20060301-01.U.asc
secunia.com/advisories/18988 · Patch
secunia.com/advisories/19130 · Vendor Advisory
secunia.com/advisories/19183 · Patch
secunia.com/advisories/20397 · Vendor Advisory
securitytracker.com/id · Patch
support.avaya.com/elmodocs2/security/ASA-2006-110.htm
novell.com/linux/security/advisories/2006_05_sr.html · Vendor Advisory
redhat.com/support/errata/RHSA-2006-0195.html · Patch
securityfocus.com/archive/1/430297/100/0/threaded
securityfocus.com/bid/5834 · Patch
bugzilla.redhat.com/bugzilla/show_bug.cgi
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9946

More vulnerabilities in tar

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free