Skip to content
Fencer Intel
high 7.5

CVE-2016-6321 in the critical feed json

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an…

published 2016-12-09 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-7248

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
15.7%
EPSS 15.7% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

Patch / fix

  • tar Debian 14, Debian 13, Debian 12 1.29b-1.1

debian advisories DEBIAN-CVE-2016-6321

  • tar Ubuntu 14.04 LTS 1.27.1-1ubuntu0.1
  • tar Ubuntu 16.04 LTS 1.28-2.1ubuntu0.1

ubuntu advisories UBUNTU-CVE-2016-6321

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tar SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for Raspberry Pi 12 SP2 +4 more 1.27.1-11.1
  • tar SLES for SAP 11 SP4, SLES 11 SP4 1.26-1.2.10.1

suse advisories SUSE-SU-2016:2896-1SUSE-SU-2016:2895-1

  • tar openSUSE Tumbleweed 1.29-2.1

opensuse advisories openSUSE-SU-2024:10382-1

  • tar Alpine 3.24, Alpine 3.23, Alpine 3.22 +18 more 1.29-r1

alpine advisories ALPINE-CVE-2016-6321

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tar Arch Linux 1.29-2

arch linux advisories AVG-64

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-6321 updated cvss 5.1

tar: Bypassing the extract path name

  • Red Hat Enterprise Linux 5 tar Red Hat Enterprise Linux 6 tar Red Hat Enterprise Linux 7 tar
    affected: workaround, no fix planned “Use the "star" utility provided by the "star" package to process archives from untrusted sources.”
  • Red Hat Enterprise Linux 5 star Red Hat Enterprise Linux 6 rmt, star Red Hat Enterprise Linux 7 rmt, spax, star, scpio
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

15.75% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • packetstormsecurity.com http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.