CVE-2005-2541

NameCVE-2005-2541
DescriptionTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)
Debian Bugs328228

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tar (PTS)jessie (security), jessie1.27.1-2+deb8u1vulnerable
stretch1.29b-1.1vulnerable
buster, sid1.30+dfsg-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tarsource(unstable)(unfixed)unimportant328228

Notes

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

Search for package or bug name: Reporting problems