{"id":"CVE-2016-6321","aliases":["ALPINE-CVE-2016-6321","BELL-CVE-2016-6321","DEBIAN-CVE-2016-6321","DLA-690-1","DSA-3702-1","EUVD-2016-7248","GHSA-4qpm-74c6-fg44","MGASA-2016-0386","SUSE-SU-2016:2895-1","SUSE-SU-2016:2896-1","UBUNTU-CVE-2016-6321","USN-3132-1","openSUSE-SU-2024:10382-1"],"status":"published","title":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29...","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.15745,"percentile":0.96885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2016-10-28T00:00:00Z","modified":"2026-11-01T10:45:09Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"tar","fixed_in":["1.29-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tar","fixed_in":["1.29b-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tar","fixed_in":["1.29b-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tar","fixed_in":["1.29b-1.1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"tar","fixed_in":["1.26+dfsg-0.1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"tar","fixed_in":["1.27.1-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"tar","fixed_in":["1.28-3.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tar","fixed_in":["1.26-1.2.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tar","fixed_in":["1.26-1.2.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"tar","fixed_in":["1.27.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"tar","fixed_in":["1.27.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"tar","fixed_in":["1.27.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"tar","fixed_in":["1.27.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"tar","fixed_in":["1.27.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"tar","fixed_in":["1.27.1-11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tar","fixed_in":["1.27.1-11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"tar","fixed_in":["1.27.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"tar","fixed_in":["1.28-2.1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29b-1.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26+dfsg-0.1+deb7u1"}]}],"versions":["1.26+dfsg-0.1"]},{"source":"osv","ecosystem":"Debian:8","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-2+deb8u1"}]}],"versions":["1.27.1-2"]},{"source":"osv","ecosystem":"Mageia:5","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-3.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26-1.2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26-1.2.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.1"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.1-1ubuntu0.1"}]}],"versions":["1.26+dfsg-8","1.27-3","1.27-4","1.27.1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28-2.1ubuntu0.1"}]}],"versions":["1.27.1-2","1.28-2ubuntu1","1.28-2.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-2.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"tar"}],"references":[{"url":"http://seclists.org/fulldisclosure/2016/Oct/102","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/93937","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201611-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://seclists.org/fulldisclosure/2016/Oct/96","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3702","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://www.ubuntu.com/usn/USN-3132-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6321"},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-4qpm-74c6-fg44"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-6321","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-6321","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6321","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0386.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19696","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3702","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162895-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007188","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6321","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162896-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/913058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6321","tags":["report"]},{"url":"https://sintonen.fi/advisories/tar-extract-pathname-bypass.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3132-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6321","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0624","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2016-12-09T22:00:00Z","modified":"2025-08-06T21:12:29.246Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-7248","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2016-12-09T22:00:00Z","modified":"2025-08-06T21:12:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:00.279926Z"}],"ghsa":[{"id":"GHSA-4qpm-74c6-fg44","title":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29...","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2022-05-13T01:09:03Z","modified":"2023-02-21T05:06:17Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:54:11.906282Z"}],"nvd":[{"id":"CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2016-12-09T22:59:00.17Z","modified":"2026-06-17T00:50:49.503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:32.79141Z"}],"osv":[{"id":"ALPINE-CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2016-12-09T22:59:00.17Z","modified":"2026-09-22T06:17:50.314025978Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"BELL-CVE-2016-6321","title":"CVE-2016-6321 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:47.50253Z","modified":"2026-01-26T09:46:59.093637Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2016-12-09T22:59:00.17Z","modified":"2026-11-08T02:45:04.712018857Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-08T02:57:30.447698Z"},{"id":"DEBIAN-CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2016-12-09T22:59:00.17Z","modified":"2026-09-22T07:02:11.266697181Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.","status":"published","published":"2016-10-28T00:00:00Z","modified":"2026-02-04T03:06:51.172951Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"DLA-690-1","title":"tar - security update","status":"published","published":"2016-10-31T00:00:00Z","modified":"2026-03-09T02:09:27.658351Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3702-1","title":"tar - security update","status":"published","published":"2016-11-01T00:00:00Z","modified":"2026-03-09T01:20:31.773228Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0386","title":"Updated tar packages fix security vulnerability","description":"Harry Sintonen discovered that GNU tar does not properly handle member\nnames containing '..', thus allowing an attacker to bypass the path names\nspecified on the command line and replace files and directories in the\ntarget directory (CVE-2016-6321).\n","status":"published","published":"2016-11-17T23:40:52Z","modified":"2026-04-16T06:22:29.085409076Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10382-1","title":"tar-1.29-2.1 on GA media","description":"These are all security issues fixed in the tar-1.29-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:49:15.806233Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:2895-1","title":"Security update for tar","description":"\nThis update for tar fixes the following issues:\n\n- Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked\n  into extracting files and directories in the given destination, regardless\n  of the path name(s) specified on the command line [bsc#1007188]\n  [CVE-2016-6321]\n","status":"published","published":"2016-11-24T07:36:08Z","modified":"2026-02-04T02:50:36.303709Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2896-1","title":"Security update for tar","description":"\nThis update for tar fixes the following issues:\n\n- Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting\n  files and directories in the given destination, regardless of the\n  path name(s) specified on the command line [bsc#1007188]\n  [CVE-2016-6321]\n- Fix Amanda integration issue (bsc#913058)\n\n","status":"published","published":"2016-11-24T07:37:01Z","modified":"2026-02-04T04:25:25.757068Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3132-1","title":"tar vulnerability","description":"Harry Sintonen discovered that tar incorrectly handled extracting files\nwhen path names are specified on the command line. If a user or automated\nsystem were tricked into processing a specially crafted archive, an\nattacker could possibly overwrite arbitrary files.\n","status":"published","published":"2016-11-21T18:08:41Z","modified":"2026-02-10T04:41:03Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}