Every CVESearch/Get API key

CVE-2013-4397

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow...

6.8 MediumFix available

CVE-2013-4397 is a medium vulnerability (CVSS 6.8) in Feep Libtar, published October 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.49%, the 92nd percentile. Fixed in libtar 1.2.20-1.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
5.49%EPSS, 92nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.2.20-1libtar +16 more

Description

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Exploit likelihood

5.49%Down 1.1 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtar
Debian:12
before 1.2.20-1
1.2.20-1
libtar
Debian:6.0
before 1.2.11-6+deb6u1, plus listed versions
1.2.11-6
1.2.11-6+deb6u1
libtar
Debian:7
before 1.2.16-1+deb7u1, plus listed versions
1.2.16-1
1.2.16-1+deb7u1
libtar
Mageia:2
before 1.2.11-10.1.mga2
1.2.11-10.1.mga2
libtar
Mageia:3
before 1.2.18-2.1.mga3
1.2.18-2.1.mga3
libtar
Red Hat:enterprise_linux:6::client
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::client
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-devel
Red Hat:enterprise_linux:6::client
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar
Red Hat:enterprise_linux:6::computenode
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::computenode
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
libtar-devel
Red Hat:enterprise_linux:6::computenode
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar
Red Hat:enterprise_linux:6::server
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::server
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-devel
Red Hat:enterprise_linux:6::server
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar
Red Hat:enterprise_linux:6::workstation
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-debuginfo
Red Hat:enterprise_linux:6::workstation
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1
libtar-devel
Red Hat:enterprise_linux:6::workstation
before 0:1.2.11-17.el6_4.1
0:1.2.11-17.el6_4.1

What each source reports

NVD Score used6.8

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
CVE-2013-4397
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE ListNo score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
CVE-2013-4397
Updated
2026-11-02
EUVDEUVD-2013-4276No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
EUVD-2013-4276
Updated
2026-11-03
GitHub AdvisoriesGHSA-x7xr-v9wq-28m3No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow...

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
GHSA-x7xr-v9wq-28m3
Updated
2026-11-02
OSVNo score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
CVE-2013-4397
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4397No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
DEBIAN-CVE-2013-4397
Updated
2026-11-02
OSVMGASA-2013-0309No score

Updated libtar packages fixes security vulnerability

Two heap-based buffer overflow flaws were found in the way libtar handled certain archives. If a user were tricked into expanding a specially-crafted archive, it could cause the libtar executable or an application using libtar to crash or, potentially, execute arbitrary code (CVE-2013-4397).

Record
MGASA-2013-0309
Updated
2026-11-02
OSVUBUNTU-CVE-2013-4397No score

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.

Record
UBUNTU-CVE-2013-4397
Updated
2026-11-02

History

History
RecordedChangedSources
facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 18 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open