QwikSec

Security Database

CVE

CWE

Training

CVE-2016-6321

Published: Dec 9, 2016

Modified: Aug 6, 2025

PUBLISHED

Description

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20161030 [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) - patch update

mailing-list

x_refsource_FULLDISC

vdb-entry

x_refsource_BID

vendor-advisory

x_refsource_GENTOO

20161026 [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321)

mailing-list

x_refsource_FULLDISC

http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d

x_refsource_CONFIRM

[bug-tar] 20161029 Re: [Bug-tar] possible fixes for CVE-2016-6321

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_DEBIAN

https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt

x_refsource_MISC

http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html

x_refsource_MISC

vendor-advisory

x_refsource_UBUNTU

[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8

mailing-list

x_refsource_MLIST

[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.