{"id":"DEBIAN-CVE-2006-6097","details":"GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.","modified":"2026-09-17T06:47:40.569484518Z","published":"2006-11-24T18:07:00Z","upstream":["CVE-2006-6097"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2006-6097"}],"affected":[{"package":{"name":"tar","ecosystem":"Debian:12","purl":"pkg:deb/debian/tar?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2"}]}],"ecosystem_specific":{"urgency":"high"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6097.json"}},{"package":{"name":"tar","ecosystem":"Debian:13","purl":"pkg:deb/debian/tar?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2"}]}],"ecosystem_specific":{"urgency":"high"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6097.json"}},{"package":{"name":"tar","ecosystem":"Debian:14","purl":"pkg:deb/debian/tar?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2"}]}],"ecosystem_specific":{"urgency":"high"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6097.json"}}],"schema_version":"1.9.0"}