CVE Feed

    Dashboard / CVE / CVE-2016-10173

    CVE-2016-10173

    Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.

    Published:Aug 22, 2016
    Last Modified:Apr 20, 2025
    EPS:Feb 1, 2017
    EPSS Score:0.04125
    CVSS Score:7.5

    Affected Products

    Vendor
    Minitar
    Product
    Archive-tar-minitar
    Vendor
    Minitar
    Product
    Minitar

    Exploits

    https://github.com/halostatue/minitar/issues/16https://github.com/halostatue/minitar/issues/16

    References

    http://www.debian.org/security/2017/dsa-3778
    http://www.openwall.com/lists/oss-security/2017/01/24/7
    http://www.openwall.com/lists/oss-security/2017/01/29/1
    http://www.securityfocus.com/bid/95874
    https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4
    https://github.com/halostatue/minitar/issues/16
    https://puppet.com/security/cve/cve-2016-10173
    https://security.gentoo.org/glsa/201702-32
    http://www.debian.org/security/2017/dsa-3778
    http://www.openwall.com/lists/oss-security/2017/01/24/7
    http://www.openwall.com/lists/oss-security/2017/01/29/1
    http://www.securityfocus.com/bid/95874
    https://github.com/halostatue/minitar/commit/e25205ecbb6277ae8a3df1e6a306d7ed4458b6e4
    https://github.com/halostatue/minitar/issues/16
    https://puppet.com/security/cve/cve-2016-10173
    https://security.gentoo.org/glsa/201702-32

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High