CVE-2007-4476

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and...

7.5 HighPublic exploitFix available

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Exploit likelihood

14.9%Down 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Record: CVE-2007-4476
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Record: CVE-2007-4476
Updated: 2026-11-02

EUVDEUVD-2007-4459 No score

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Record: EUVD-2007-4459
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qc9f-9qmm-9663 No score

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and...

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Record: GHSA-qc9f-9qmm-9663
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Record: CVE-2007-4476
Updated: 2026-11-02

OSVDEBIAN-CVE-2007-4476 No score

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Record: DEBIAN-CVE-2007-4476
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cpio` Debian:12	before 2.9-5	2.9-5
`cpio` Debian:13	before 2.9-5	2.9-5
`cpio` Debian:14	before 2.9-5	2.9-5
`tar` Debian:12	before 1.18-1	1.18-1
`tar` Debian:13	before 1.18-1	1.18-1
`tar` Debian:14	before 1.18-1	1.18-1
`tar` Debian:4.0	before 1.16-2etch1, plus listed versions 1.16-2	1.16-2etch1
`tar` Debian:3.1	before 1.14-2.4, plus listed versions 1.14-21.14-2.11.14-2.21.14-2.3	1.14-2.4
`cpio` Debian:4.0	before 2.6-18.1+etch1, plus listed versions 2.6-172.6-18	2.6-18.1+etch1
`tar` Red Hat:enterprise_linux:4::as	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1

Show 15 moreShow less

Affected packages
Package	Affected	Fixed
`tar-debuginfo` Red Hat:enterprise_linux:4::as	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1
`tar` Red Hat:enterprise_linux:4::desktop	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1
`tar-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1
`tar` Red Hat:enterprise_linux:4::es	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1
`tar-debuginfo` Red Hat:enterprise_linux:4::es	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1
`tar` Red Hat:enterprise_linux:4::ws	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1
`tar-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:1.14-13.el4_8.1	0:1.14-13.el4_8.1
`tar` Red Hat:enterprise_linux:5::client	before 2:1.15.1-23.0.1.el5_4.2	2:1.15.1-23.0.1.el5_4.2
`tar-debuginfo` Red Hat:enterprise_linux:5::client	before 2:1.15.1-23.0.1.el5_4.2	2:1.15.1-23.0.1.el5_4.2
`tar` Red Hat:enterprise_linux:5::server	before 2:1.15.1-23.0.1.el5_4.2	2:1.15.1-23.0.1.el5_4.2
`tar-debuginfo` Red Hat:enterprise_linux:5::server	before 2:1.15.1-23.0.1.el5_4.2	2:1.15.1-23.0.1.el5_4.2
`cpio` Red Hat:enterprise_linux:5::client	before 0:2.6-23.el5_4.1	0:2.6-23.el5_4.1
`cpio-debuginfo` Red Hat:enterprise_linux:5::client	before 0:2.6-23.el5_4.1	0:2.6-23.el5_4.1
`cpio` Red Hat:enterprise_linux:5::server	before 0:2.6-23.el5_4.1	0:2.6-23.el5_4.1
`cpio-debuginfo` Red Hat:enterprise_linux:5::server	before 0:2.6-23.el5_4.1	0:2.6-23.el5_4.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service	2007-11-14

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	affected, aliases, exploits, facts, references, title	Exploit-DB, GitHub Advisories, OSV
Nov 2, 2026	first indexed	CVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-4476 is a high vulnerability (CVSS 7.5) in Gnu Tar, published September 5, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.9%, the 96th percentile. Fixed in cpio 2.9-5.

References

Show 45 moreShow less