{"id":"CVE-2005-2541","aliases":["BELL-CVE-2005-2541","DEBIAN-CVE-2005-2541","EUVD-2005-2542","GHSA-vwpx-f983-qg79","ROOT-OS-DEBIAN-13-CVE-2005-2541"],"status":"published","title":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may...","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03992,"percentile":0.90589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2005-08-10T04:00:00Z","modified":"2026-10-23T03:47:27Z","fixes":[{"ecosystem":"Root:Debian:13","package":"tar","fixed_in":["1.35+dfsg-3.1.aikido.3","1.35+dfsg-3.1.root.io.1","1.35+dfsg-3.1.root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-tar","fixed_in":["1.35+dfsg-3.1.aikido.3","1.35+dfsg-3.1.root.io.1","1.35+dfsg-3.1.root.io.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34+dfsg-1.2","1.34+dfsg-1.2+deb12u1","1.34+dfsg-1.3","1.34+dfsg-1.4","1.35+dfsg-1","1.35+dfsg-2","1.35+dfsg-3","1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6"]},{"source":"osv","ecosystem":"Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6"]},{"source":"osv","ecosystem":"Debian:14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.35+dfsg-3.1","1.35+dfsg-4","1.35+dfsg-5","1.35+dfsg-5+hurd.1","1.35+dfsg-6"]},{"source":"osv","ecosystem":"Root:Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3.1.aikido.3"},{"fixed":"1.35+dfsg-3.1.root.io.1"},{"fixed":"1.35+dfsg-3.1.root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35+dfsg-3.1.aikido.3"},{"fixed":"1.35+dfsg-3.1.root.io.1"},{"fixed":"1.35+dfsg-3.1.root.io.2"}]}]}],"products":[{"vendor":"gnu","product":"tar"}],"references":[{"url":"http://marc.info/?l=bugtraq\u0026m=112327628230258\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541"},{"url":"https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-vwpx-f983-qg79"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2005-2541","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2005-2541","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","status":"published","published":"2005-08-10T04:00:00Z","modified":"2024-08-07T22:30:01.119Z","updated_at":"2026-11-02T14:33:38.187792Z"}],"euvd":[{"id":"EUVD-2005-2542","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","status":"published","published":"2005-08-10T04:00:00Z","modified":"2024-08-07T22:30:01Z","updated_at":"2026-11-03T01:15:30.566873Z"}],"ghsa":[{"id":"GHSA-vwpx-f983-qg79","title":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may...","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","status":"published","published":"2022-05-01T02:09:12Z","modified":"2025-04-03T04:16:09Z","updated_at":"2026-11-02T15:00:42.132742Z"}],"nvd":[{"id":"CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","status":"published","published":"2005-08-10T04:00:00Z","modified":"2026-06-16T22:15:10.157Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:00:56.147496Z"}],"osv":[{"id":"BELL-CVE-2005-2541","title":"CVE-2005-2541 does not affect BellSoft software","status":"withdrawn","published":"2005-08-10T04:00:00Z","modified":"2026-01-28T07:19:06.065938Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"critical"}],"updated_at":"2026-11-02T15:28:12.886815Z"},{"id":"CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","status":"published","published":"2005-08-10T04:00:00Z","modified":"2026-04-10T03:38:10.162571Z","updated_at":"2026-11-02T15:43:56.581247Z"},{"id":"DEBIAN-CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.","status":"published","published":"2005-08-10T04:00:00Z","modified":"2026-10-23T03:47:27.432195544Z","updated_at":"2026-11-02T15:45:22.831407Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2005-2541","title":"CVE-2005-2541 in tar - Patched by Root","description":"Root has patched CVE-2005-2541 in the tar package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T16:38:16Z","modified":"2026-08-24T18:45:07.210915194Z","updated_at":"2026-11-02T15:53:32.570806Z"}]}}