CVE-2002-0399
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions...
CVE-2002-0399 is a medium vulnerability (CVSS 5.0) in Gnu Tar, published October 1, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.59%, the 89th percentile. Fixed in tar 1.34-2.2.
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
- Record
CVE-2002-0399- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
- Record
CVE-2002-0399- Updated
- 2026-11-02
EUVDEUVD-2002-0396 No score
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
- Record
EUVD-2002-0396- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c6fq-h555-8326 No score
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions...
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
- Record
GHSA-c6fq-h555-8326- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11422-1 No score
tar-1.34-2.2 on GA media
These are all security issues fixed in the tar-1.34-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11422-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
taropenSUSE:Tumbleweed |
before 1.34-2.2 | 1.34-2.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
sunsolve.sun.com/search/document.do?assetkey=1-26-47800-1
secunia.com/advisories/26673
redhat.com/support/errata/RHSA-2002-096.html
securityfocus.com/bid/5834
novell.com/linux/security/advisories/2007_19_sr.html
Show 21 moreShow less
linuxsecurity.com/advisories/other_advisory-2400.html
issues.rpath.com/browse/RPL-1631
marc.info?l=bugtraq&m=103419290219680&w=2
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000538
iss.net/security_center/static/10224.php
mandriva.com/security/advisories?name=MDKSA-2002:066
nvd.nist.gov/vuln/detail/CVE-2002-0399
github.com/advisories/GHSA-c6fq-h555-8326
suse.com/security/cve/CVE-2001-1267