CVE-2013-4420
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all...
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
CVE-2013-4420- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
CVE-2013-4420- Updated
- 2026-11-02
EUVDEUVD-2013-4297 No score
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
EUVD-2013-4297- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-35h8-7h6c-x54q No score
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all...
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
GHSA-35h8-7h6c-x54q- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVAZL-34945 No score
CVE-2013-4420 affecting package libtar for versions less than 1.2.20-11
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
AZL-34945- Updated
- 2026-11-02
OSVAZL-6651 No score
CVE-2013-4420 affecting package libtar for versions less than 1.2.20-8
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
AZL-6651- Updated
- 2026-11-02
Show 4 moreShow less
OSV No score
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
CVE-2013-4420- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4420 No score
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
DEBIAN-CVE-2013-4420- Updated
- 2026-11-02
OSVMGASA-2014-0090 No score
Updated libtar package fixes security vulnerability
A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tar_extract_glob and tar_extract_all prefix parameter (CVE-2013-4420).
- Record
MGASA-2014-0090- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4420 No score
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
- Record
UBUNTU-CVE-2013-4420- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libtarAzure Linux:3 |
before 1.2.20-11 | 1.2.20-11 |
libtarAzure Linux:2 |
before 1.2.20-8 | 1.2.20-8 |
libtarDebian:12 |
before 1.2.20-2 | 1.2.20-2 |
libtarDebian:6.0 |
before 1.2.11-6+deb6u2, plus listed versions 1.2.11-6 |
1.2.11-6+deb6u2 |
libtarDebian:7 |
before 1.2.16-1+deb7u2, plus listed versions 1.2.16-11.2.16-1+deb7u1 |
1.2.16-1+deb7u2 |
libtarMageia:3 |
before 1.2.18-2.2.mga3 | 1.2.18-2.2.mga3 |
libtarMageia:4 |
before 1.2.20-2.1.mga4 | 1.2.20-2.1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4420 is a medium vulnerability (CVSS 5.8) in Feep Libtar, published February 18, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.40%, the 88th percentile. Fixed in libtar 1.2.20-11.