CVE-2005-2541 Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
HighCVSS 10.0
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU tar | = 1.15.1 | No fix listed |
| debian/tar(Debian:12) | All versions | No fix listed |
| debian/tar(Debian:12) | = 1.34+dfsg-1.2 | No fix listed |
| debian/tar(Debian:12) | = 1.34+dfsg-1.2+deb12u1 | No fix listed |
| debian/tar(Debian:12) | = 1.34+dfsg-1.3 | No fix listed |
| debian/tar(Debian:12) | = 1.34+dfsg-1.4 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-1 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-2 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-3 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-3.1 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-4 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-5 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-5+hurd.1 | No fix listed |
| debian/tar(Debian:12) | = 1.35+dfsg-6 | No fix listed |
| debian/tar(Debian:13) | All versions | No fix listed |
| debian/tar(Debian:13) | = 1.35+dfsg-3.1 | No fix listed |
| debian/tar(Debian:13) | = 1.35+dfsg-4 | No fix listed |
| debian/tar(Debian:13) | = 1.35+dfsg-5 | No fix listed |
| debian/tar(Debian:13) | = 1.35+dfsg-5+hurd.1 | No fix listed |
| debian/tar(Debian:13) | = 1.35+dfsg-6 | No fix listed |
| debian/tar(Debian:14) | All versions | No fix listed |
| debian/tar(Debian:14) | = 1.35+dfsg-3.1 | No fix listed |
| debian/tar(Debian:14) | = 1.35+dfsg-4 | No fix listed |
| debian/tar(Debian:14) | = 1.35+dfsg-5 | No fix listed |
| debian/tar(Debian:14) | = 1.35+dfsg-5+hurd.1 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tar(Debian:14) | = 1.35+dfsg-6 | No fix listed |
References
- 20050804 tar preserves setuid bit mailing-list
- [guacamole-issues] 20210618 [jira] [Created] (GUACAMOLE-1368) Latest docker image fails security scans. mailing-list
- Debian Security Tracker CVE-2005-2541 vendor-advisory
- bugs.debian.org issue-tracking