What’s Vulnerable › Vulnerabilities

CVE-2018-12015

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-07 · updated 2026-06-17
• Weakness: CWE-59

Description

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

Affected products

• macOS: before 10.14.4 — fixed in 10.14.4
• Archive::Tar Project Archive::Tar: through 2.28
• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10, 18.04
• Debian Linux: 8.0, 9.0
• NetApp Data Ontap Edge: all versions
• NetApp OnCommand Workflow Automation: all versions
• NetApp Snap Creator Framework: all versions
• NetApp Snapdrive: all versions
• perl: through 5.26.2

How to fix

Upgrade to a fixed version: macOS 10.14.4. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2019/Mar/49
• http://www.securityfocus.com/bid/104423
• http://www.securitytracker.com/id/1041048
• https://access.redhat.com/errata/RHSA-2019:2097
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834
• https://seclists.org/bugtraq/2019/Mar/42
• https://security.netapp.com/advisory/ntap-20180927-0001/
• https://support.apple.com/kb/HT209600
• https://usn.ubuntu.com/3684-1/
• https://usn.ubuntu.com/3684-2/
• https://www.debian.org/security/2018/dsa-4226
• https://www.oracle.com/security-alerts/cpujul2020.html

Get alerted when CVE-2018-12015 or the next vulnerability affects your stack