CVE-2005-2541
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may...
CVE-2005-2541 is a high vulnerability (CVSS 10.0) in Gnu Tar, published August 10, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.99%, the 90th percentile. Fixed in tar 1.35+dfsg-3.1.aikido.3.
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
Exploit likelihood
What each source reports
NVD Score used
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
- Record
CVE-2005-2541- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
- Record
CVE-2005-2541- Updated
- 2026-11-02
EUVDEUVD-2005-2542 No score
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
- Record
EUVD-2005-2542- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwpx-f983-qg79 No score
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may...
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
- Record
GHSA-vwpx-f983-qg79- Updated
- 2026-11-02
OSVBELL-CVE-2005-2541
CVE-2005-2541 does not affect BellSoft software
- Record
BELL-CVE-2005-2541- CVSS 2.0
- 10.0 Critical
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
OSV No score
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
- Record
CVE-2005-2541- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-2541 No score
Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
- Record
DEBIAN-CVE-2005-2541- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2005-2541 No score
CVE-2005-2541 in tar - Patched by Root
Root has patched CVE-2005-2541 in the tar package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2005-2541- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tarDebian:12 |
All versions, plus listed versions 1.34+dfsg-1.21.34+dfsg-1.2+deb12u11.34+dfsg-1.31.34+dfsg-1.41.35+dfsg-1 Show 7 moreShow less1.35+dfsg-21.35+dfsg-31.35+dfsg-3.11.35+dfsg-41.35+dfsg-51.35+dfsg-5+hurd.11.35+dfsg-6 |
None known |
tarDebian:13 |
All versions, plus listed versions 1.35+dfsg-3.11.35+dfsg-41.35+dfsg-51.35+dfsg-5+hurd.11.35+dfsg-6 |
None known |
tarDebian:14 |
All versions, plus listed versions 1.35+dfsg-3.11.35+dfsg-41.35+dfsg-51.35+dfsg-5+hurd.11.35+dfsg-6 |
None known |
tarRoot:Debian:13 |
before 1.35+dfsg-3.1.aikido.3 | 1.35+dfsg-3.1.aikido.31.35+dfsg-3.1.root.io.11.35+dfsg-3.1.root.io.2 |
rootio-tarRoot:Debian:13 |
before 1.35+dfsg-3.1.aikido.3 | 1.35+dfsg-3.1.aikido.31.35+dfsg-3.1.root.io.11.35+dfsg-3.1.root.io.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
marc.info?l=bugtraq&m=112327628230258&w=2
lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2005-2541
github.com/advisories/GHSA-vwpx-f983-qg79
docs.bell-sw.com/security/cves/CVE-2005-2541
security-tracker.debian.org/tracker/CVE-2005-2541