CVE-2005-2541

NameCVE-2005-2541
DescriptionTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs328228

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tar (PTS)bullseye1.34+dfsg-1+deb11u1vulnerable
bookworm1.34+dfsg-1.2+deb12u1vulnerable
sid, trixie1.35+dfsg-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tarsource(unstable)(unfixed)unimportant328228

Notes

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

Search for package or bug name: Reporting problems