CVE-2006-6097
- State
- Published
- Severity
- Not scored
- Published
- Nov 24, 2006
- Updated
- Aug 7, 2024
- Reserved
- Nov 24, 2006
Description
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 23117third-party-advisory
- oval:org.mitre.oval:def:10963vdb-entrysignature
- https://issues.rpath.com/browse/RPL-821
- 1918third-party-advisory
- TA07-072Athird-party-advisory
- 21235vdb-entry
- 23146third-party-advisory
- 20061121 GNU tar directory traversalmailing-list
- http://kb.vmware.com/KanisaPlatform/Publishing/817/2240267_f.SAL_Public.html
- APPLE-SA-2007-03-13vendor-advisory
- 23209third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- ADV-2006-5102vdb-entry
- 2006-0068vendor-advisory
- 23142third-party-advisory
- 23314third-party-advisory
- ADV-2007-1171vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2007-015.htm
- GLSA-200612-10vendor-advisory
- 23198third-party-advisory
- 23115third-party-advisory
- http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.html
- 20061201 rPSA-2006-0222-1 tarmailing-list
- 23911third-party-advisory
- USN-385-1vendor-advisory
- 20070330 VMSA-2007-0002 VMware ESX security updatesmailing-list
- 23173third-party-advisory
- RHSA-2006:0749vendor-advisory
- FreeBSD-SA-06:26vendor-advisory
- 1017423vdb-entry
- 24636third-party-advisory
- DSA-1223vendor-advisory
- ADV-2007-0930vdb-entry
- 23443third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216937
- MDKSA-2006:219vendor-advisory
- OpenPKG-SA-2006.038vendor-advisory
- ADV-2006-4717vdb-entry
- 23514third-party-advisory
- SSA:2006-335-01vendor-advisory
- 24479third-party-advisory
- 23163third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.