p PatchFirst

CVE-2015-8860

CVE-2015-8860

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

CVSS 7.5 · High · EPSS 4.0% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • node-tar Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.1-1

    Update to 2.2.1-1

  • node-tar Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.2.1-1

    Update to 2.2.1-1

  • node-tar Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.2.1-1

    Update to 2.2.1-1

  • tar npm

    Affected ranges
    • SEMVER: < 2.0.0

    Update to 2.0.0

  • node-tar Ubuntu:Pro:14.04:LTS

    Versions
    • 0.1.18-1
    Affected ranges
    • ECOSYSTEM: < 0.1.18-1ubuntu0.1~esm1

    Update to 0.1.18-1ubuntu0.1~esm1

  • node-tar Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.3-2
    Affected ranges
    • ECOSYSTEM: < 1.0.3-2ubuntu0.1~esm1

    Update to 1.0.3-2ubuntu0.1~esm1

Original sources

Check your server →