CVE-2007-4829 Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name....
MediumCVSS 6.8
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| archivetar project archivetar | <= 1.36 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 8.10 | No fix listed |
| debian/perl(Debian:12) | < 5.10.0-19 | 5.10.0-19 |
| debian/perl(Debian:13) | < 5.10.0-19 | 5.10.0-19 |
| debian/perl(Debian:14) | < 5.10.0-19 | 5.10.0-19 |
References
- 40410 broken-link vdb-entry
- rt.cpan.org mailing-list third-party-advisory
- rt.cpan.org mailing-list third-party-advisory
- 27539 third-party-advisory
- 33116 third-party-advisory
- 33314 third-party-advisory
- GLSA-200812-10 third-party-advisory vendor-advisory
- 26355 third-party-advisory vdb-entry
- USN-700-1 third-party-advisory vendor-advisory
- USN-700-2 third-party-advisory vendor-advisory
- ADV-2007-3755 permissions-required vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- perl-archivetar-directory-traversal(38285) third-party-advisory vdb-entry
- issues.rpath.com broken-link
- oval:org.mitre.oval:def:11658 signature third-party-advisory vdb-entry
- Debian Security Tracker CVE-2007-4829 vendor-advisory