What is CVE-2013-4420?

CVE-2013-4420 is a vulnerability in Feep Libtar, classified under Path Traversal. Published 2014-02-20.

Is CVE-2013-4420 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Feep Libtar

CVE-2013-4420

Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.033 (87.1th percentile) — read the EPSS interpretation.

Affected products

Feep Libtar — versions 1.2.11, 1.2.13, 1.2.14
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

andir/nixos-issue-db-example

References

secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN)
secalert@redhat.com (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2013-4420?: CVE-2013-4420 is a vulnerability in Feep Libtar, classified under Path Traversal. Published 2014-02-20.
Is CVE-2013-4420 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.