Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the filename parameter, aka POINTYFEATHER.

Directory traversal vulnerability in the containsdotdot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

A heap-based buffer overflow flaw was found in the way tar and cpio archive manipulation tools expanded archives with certain character in the archive name. If a local user was tricked into expanding a specially-crafted archive, it could cause the tar, cpio executables to crash or, potentially, to execute arbitrary code with the privileges of the user running the utility.

Link to advisory: [1] http://www.agrs.tu-berlin.de/index.php?id=78327

Acknowledgements:

Red Hat would like to thank Jakob Lell for responsibly reporting this issue.