Описание
Security update for tar
This update for tar fixes the following issues:
- Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line [bsc#1007188] [CVE-2016-6321]
Список пакетов
SUSE Linux Enterprise Server 11 SP4
tar-1.26-1.2.10.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4
tar-1.26-1.2.10.1
Ссылки
- Link for SUSE-SU-2016:2895-1
- E-Mail link for SUSE-SU-2016:2895-1
- SUSE Security Ratings
- SUSE Bug 1007188
- SUSE CVE CVE-2016-6321 page
Описание
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
Затронутые продукты
SUSE Linux Enterprise Server 11 SP4:tar-1.26-1.2.10.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4:tar-1.26-1.2.10.1
Ссылки
- CVE-2016-6321
- SUSE Bug 1007188
- SUSE Bug 1123796