Every CVE Search/ Get API key

CVE-2013-4397

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow...

6.8 MediumFix available

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Exploit likelihood

5.49%Down 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
CVE-2013-4397
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
CVE-2013-4397
Updated
2026-11-02
EUVDEUVD-2013-4276 No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
EUVD-2013-4276
Updated
2026-11-03
GitHub AdvisoriesGHSA-x7xr-v9wq-28m3 No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow...

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
GHSA-x7xr-v9wq-28m3
Updated
2026-11-02
OSV No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
CVE-2013-4397
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4397 No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
DEBIAN-CVE-2013-4397
Updated
2026-11-02
OSVMGASA-2013-0309 No score

Updated libtar packages fixes security vulnerability

Two heap-based buffer overflow flaws were found in the way libtar handled certain archives. If a user were tricked into expanding a specially-crafted archive, it could cause the libtar executable or an application using libtar to crash or, potentially, execute arbitrary code (CVE-2013-4397).

Record
MGASA-2013-0309
Updated
2026-11-02
OSVUBUNTU-CVE-2013-4397 No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
UBUNTU-CVE-2013-4397
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtar
Debian:12
 before 1.2.20-1
1.2.20-1
libtar
Debian:6.0
 before 1.2.11-6+deb6u1, plus listed versions
1.2.11-6
1.2.11-6+deb6u1
libtar
Debian:7
 before 1.2.16-1+deb7u1, plus listed versions
1.2.16-1
1.2.16-1+deb7u1
libtar
Mageia:2
 before 1.2.11-10.1.mga2
1.2.11-10.1.mga2
libtar
Mageia:3
 before 1.2.18-2.1.mga3
1.2.18-2.1.mga3
libtar
Red Hat:enterprise_linux:6::client
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-devel
Red Hat:enterprise_linux:6::client
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
libtar-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar
Red Hat:enterprise_linux:6::server
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-devel
Red Hat:enterprise_linux:6::server
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4397 is a medium vulnerability (CVSS 6.8) in Feep Libtar, published October 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.49%, the 92nd percentile. Fixed in libtar 1.2.20-1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open