What’s Vulnerable › Vulnerabilities

CVE-2007-4476

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2007-09-05 · updated 2026-06-16
• Weakness: CWE-119

Description

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

Affected products

• Canonical Ubuntu Linux: 6.06, 7.04, 7.10
• Debian Linux: 3.1, 4.0
• GNU Tar: before 1.19 — fixed in 1.19

How to fix

Upgrade to a fixed version: GNU Tar 1.19. Check the vendor advisory for mitigations.

References

• http://bugs.gentoo.org/show_bug.cgi?id=196978
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
• http://secunia.com/advisories/26674
• http://secunia.com/advisories/26987
• http://secunia.com/advisories/27331
• http://secunia.com/advisories/27453
• http://secunia.com/advisories/27514
• http://secunia.com/advisories/27681
• http://secunia.com/advisories/27857
• http://secunia.com/advisories/28255
• http://secunia.com/advisories/29968

Get alerted when CVE-2007-4476 or the next vulnerability affects your stack