Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2013-4420

17
FAUCET Score

CVE-2013-4420 describes multiple directory traversal vulnerabilities in libtar versions 1.2.20 and earlier, specifically within the tar_extract_glob and tar_extract_all functions. This vulnerability allows remote attackers to overwrite arbitrary files on affected systems by crafting a malicious tar file containing ".." (dot dot) sequences. With a CVSS score of 5.8, it has a medium severity, indicating a network-based attack with medium complexity that could lead to partial integrity and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage for this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.2.20CPE matchmatch criteria
cpe:2.3:a:feep:libtar:*:*:*:*:*:*:*:*
1.2.11CPE matchmatch criteria
cpe:2.3:a:feep:libtar:1.2.11:*:*:*:*:*:*:*
1.2.13CPE matchmatch criteria
cpe:2.3:a:feep:libtar:1.2.13:*:*:*:*:*:*:*
1.2.14CPE matchmatch criteria
cpe:2.3:a:feep:libtar:1.2.14:*:*:*:*:*:*:*
1.2.15CPE matchmatch criteria
cpe:2.3:a:feep:libtar:1.2.15:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

5.8MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:P

Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Exploitability Score
8.6
Impact Score
4.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
3.28%
Probability of exploitation in next 30 days
EPSS Percentile
87.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0328 is in the 81st percentile among its peer group of 19,956 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (44)

microsoftpatch availablevia msrc
Product: libtar-devel-1.2.20-11.azl3.aarch64.rpm on Azure Linux 3.0 ARMFixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: cbl2 libtar 1.2.20-8 on CBL Mariner 2.0Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: azl3 libtar 1.2.20-11 on Azure Linux 3.0Fixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: 18850-17084Fixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: 19222-16820Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 19223-16823Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-1.2.20-11.azl3.aarch64.rpm on Azure Linux 3.0 ARMFixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: cm1 libtar 1.2.20-8 on CBL Mariner 1.0Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13045-12137Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13046-12137Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13047-12137Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13048-12138Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13049-12138Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13050-12138Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13051-12139Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13052-12139Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13053-12139Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13054-12140Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13055-12140Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13056-12140Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: 13057-12356Fixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: 13058-12356Fixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: 13059-12357Fixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: 13060-12357Fixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-1.2.20-8.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-devel-1.2.20-8.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-debuginfo-1.2.20-8.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-1.2.20-8.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-devel-1.2.20-8.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-debuginfo-1.2.20-8.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-1.2.20-8.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-devel-1.2.20-8.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-debuginfo-1.2.20-8.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-1.2.20-8.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-devel-1.2.20-8.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-debuginfo-1.2.20-8.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 1.2.20-8
microsoftpatch availablevia msrc
Product: libtar-1.2.20-11.azl3.x86_64.rpm on Azure Linux 3.0 x64Fixed in: 1.2.20-11
microsoftpatch availablevia msrc
Product: libtar-devel-1.2.20-11.azl3.x86_64.rpm on Azure Linux 3.0 x64Fixed in: 1.2.20-11
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: libtar
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: libtar

Vendor Advisories (4)

microsoft2024-Jun/CVE-2013-4420

CVE-2013-4420

Jun 11, 2024
microsoft2020-Aug/CVE-2013-4420

CVE-2013-4420

Aug 11, 2020
microsoft2014-Feb/CVE-2013-4420Moderate

Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.

Feb 2, 2014
redhatCVE-2013-4420Low

libtar: missing validation of file names

Oct 1, 2013

References

bugs.debian.org / cgi-bin/bugreport.cgi
lists.feep.net / pipermail/libtar/2014-February/000403.html
debian.org / security/2014/dsa-2863