Fluid Attacks Database

Description

Symlink Arbitrary File Overwrite in tar Versions of tar prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because tar does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.

Recommendation

Update to version 2.0.0 or later

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
npm	tar	>=0 <2.0.0	2.0.0
debian 13	node-tar	>=0 <2.2.1-1	2.2.1-1
debian 12	node-tar	>=0 <2.2.1-1	2.2.1-1
debian 14	node-tar	>=0 <2.2.1-1	2.2.1-1
debian 11	node-tar	>=0 <2.2.1-1	2.2.1-1

Aliases

1. CVE-2015-88602. NVD-2015-88603. OSV-2015-88604. OSV-DEBIAN-2015-88605. GHSA-gfjr-3jmm-4g9v6. GCVE-2015-88607. SECURITY-TRACKER-CVE-2015-8860

References

1. https://github.com/npm/npm/releases/tag/v2.7.52. https://www.npmjs.com/advisories/573. http://www.openwall.com/lists/oss-security/2016/04/20/11

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.