Read the docs
TI-2007-03999 Aliases CVE-2007-4131GHSA-43w6-q9mv-9cwf

Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU…

Priority LOW 35Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

Why it matters now

EPSS 0.02743 86th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:4.0:*:as:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:4.0:*:desktop:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:4.0:*:es:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:4.0:*:ws:*:*:*:*:*4.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:server:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:client:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:*1Running onRpath
cpe:2.3:a:gnu:tar:1.13:*:*:*:*:*:*:*1.13VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.5:*:*:*:*:*:*:*1.13.5VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.11:*:*:*:*:*:*:*1.13.11VulnerableGNU
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:as:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:desktop:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:es:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:ws:*:*:*:*:* Versions 4.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:server:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:client:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:o:rpath:rpath_linux:1:*:*:*:*:*:*:* Versions 1 Running on ·Rpath
  • cpe:2.3:a:gnu:tar:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.5:*:*:*:*:*:*:* Versions 1.13.5 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.11:*:*:*:*:*:*:* Versions 1.13.11 Vulnerable ·GNU
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnu:tar:1.13.14:*:*:*:*:*:*:*1.13.14VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.16:*:*:*:*:*:*:*1.13.16VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.17:*:*:*:*:*:*:*1.13.17VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.18:*:*:*:*:*:*:*1.13.18VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.19:*:*:*:*:*:*:*1.13.19VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.25:*:*:*:*:*:*:*1.13.25VulnerableGNU
cpe:2.3:a:gnu:tar:1.14:*:*:*:*:*:*:*1.14VulnerableGNU
cpe:2.3:a:gnu:tar:1.14.90:*:*:*:*:*:*:*1.14.90VulnerableGNU
cpe:2.3:a:gnu:tar:1.15:*:*:*:*:*:*:*1.15VulnerableGNU
cpe:2.3:a:gnu:tar:1.15.1:*:*:*:*:*:*:*1.15.1VulnerableGNU
cpe:2.3:a:gnu:tar:1.15.90:*:*:*:*:*:*:*1.15.90VulnerableGNU
cpe:2.3:a:gnu:tar:1.15.91:*:*:*:*:*:*:*1.15.91VulnerableGNU
cpe:2.3:a:gnu:tar:1.16:*:*:*:*:*:*:*1.16VulnerableGNU
  • cpe:2.3:a:gnu:tar:1.13.14:*:*:*:*:*:*:* Versions 1.13.14 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.16:*:*:*:*:*:*:* Versions 1.13.16 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.17:*:*:*:*:*:*:* Versions 1.13.17 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.18:*:*:*:*:*:*:* Versions 1.13.18 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.19:*:*:*:*:*:*:* Versions 1.13.19 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.25:*:*:*:*:*:*:* Versions 1.13.25 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.14.90:*:*:*:*:*:*:* Versions 1.14.90 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15.1:*:*:*:*:*:*:* Versions 1.15.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15.90:*:*:*:*:*:*:* Versions 1.15.90 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15.91:*:*:*:*:*:*:* Versions 1.15.91 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·GNU

Remediation

Red Hat 1 advisory

  • RHSA-2007:0860 Released 2007-08-23 · Red Hat rating Moderate
    tar security update
    • Red Hat Enterprise Linux (v. 5 server) tar-2:1.15.1-23.0.1.el5, tar-2:1.15.1-23.0.1.el5.i386, tar-2:1.15.1-23.0.1.el5.ia64 +1
    • Red Hat Enterprise Linux AS version 4 tar-1.14-12.5.1.RHEL4, tar-1.14-12.5.1.RHEL4.i386, tar-1.14-12.5.1.RHEL4.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) tar-2:1.15.1-23.0.1.el5, tar-2:1.15.1-23.0.1.el5.i386
    • Red Hat Enterprise Linux Desktop version 4 tar-1.14-12.5.1.RHEL4, tar-1.14-12.5.1.RHEL4.i386
    • Red Hat Enterprise Linux ES version 4 tar-1.14-12.5.1.RHEL4, tar-1.14-12.5.1.RHEL4.i386, tar-1.14-12.5.1.RHEL4.ia64
    • Red Hat Enterprise Linux WS version 4 tar-1.14-12.5.1.RHEL4, tar-1.14-12.5.1.RHEL4.i386, tar-1.14-12.5.1.RHEL4.ia64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2007:0860
Red Hat Enterprise Linux AS version 4Fixed RHSA-2007:0860
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2007:0860
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2007:0860
Red Hat Enterprise Linux ES version 4Fixed RHSA-2007:0860
Red Hat Enterprise Linux WS version 4Fixed RHSA-2007:0860

Timeline

  1. 2026-10-02 Threatist record created from CVE-2007-4131
  2. 2026-10-03 Alias added: GHSA-43w6-q9mv-9cwf

References

Patch 1

Advisory 11

Other 8

  • TI-2019-07294 pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when… CVSS 3.1HIGH 7.5
  • TI-2016-05412 Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14… CVSS 3.1HIGH 7.5
  • TI-2022-23920 GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of… CVSS 3.1MEDIUM 5.5
  • TI-2025-28801 Path traversal in GNU Tar CVSS 3.1MEDIUM 4.1
  • TI-2005-02406 Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which… CVSS 2.0HIGH 10.0
  • TI-2007-04334 Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack… CVSS 2.0HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences