CVE catalog

CVE-2011-5325

busybox: CVE-2011-5325

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
6.98% · Oct 25, 2026

Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbusyboxsid1:1.38.0-3fixed
Debianbusyboxforky1:1.38.0-3fixed
Debianbusyboxtrixie1:1.37.0-6fixed
Debianbusyboxbookworm1:1.35.0-4+deb12u1fixed
Ubuntubusybox14.041:1.20.0-8.1ubuntu1vulnerable
Ubuntubusybox14.041:1.20.0-9ubuntu1vulnerable
Ubuntubusybox14.041:1.20.0-9ubuntu2vulnerable
Ubuntubusybox14.041:1.21.0-1ubuntu1vulnerable
Ubuntubusybox14.041:1.21.0-1ubuntu1.4fixed
Ubuntubusybox16.041:1.22.0-15ubuntu1vulnerable
Ubuntubusybox16.041:1.22.0-15ubuntu1.4fixed
Ubuntubusybox18.041:1.22.0-19ubuntu2vulnerable
Ubuntubusybox18.041:1.27.2-1ubuntu3vulnerable
Ubuntubusybox18.041:1.27.2-1ubuntu4vulnerable
Ubuntubusybox18.041:1.27.2-2ubuntu2vulnerable
Ubuntubusybox18.041:1.27.2-2ubuntu3vulnerable
Ubuntubusybox18.041:1.27.2-2ubuntu3.1vulnerable
Ubuntubusybox18.041:1.27.2-2ubuntu3.2fixed
Opensusebusyboxleap 15.31.26.2-4.5.1fixed
Opensusebusybox-staticleap 15.31.26.2-4.5.1fixed
Susebusyboxlinux enterprise module for basesystem 15 sp41.35.0-150400.3.3.1fixed
Opensusebusyboxleap 15.41.35.0-150400.3.3.1fixed
Susebusyboxlinux enterprise real time 15 sp21.34.1-4.9.1fixed
Susebusyboxlinux enterprise module for basesystem 15 sp31.34.1-4.9.1fixed
Susebusyboxlinux enterprise high performance computing 15-espos1.34.1-4.9.1fixed
Susebusyboxlinux enterprise high performance computing 15-ltss1.34.1-4.9.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp1-espos1.34.1-4.9.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp1-ltss1.34.1-4.9.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp2-espos1.34.1-4.9.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp2-ltss1.34.1-4.9.1fixed
Susebusyboxlinux enterprise server 15-ltss1.34.1-4.9.1fixed
Susebusyboxlinux enterprise server 15 sp1-bcl1.34.1-4.9.1fixed
Susebusyboxlinux enterprise server 15 sp1-ltss1.34.1-4.9.1fixed
Susebusyboxlinux enterprise server 15 sp2-bcl1.34.1-4.9.1fixed
Susebusyboxlinux enterprise server 15 sp2-ltss1.34.1-4.9.1fixed
Susebusyboxlinux enterprise server for sap applications 151.34.1-4.9.1fixed
Susebusyboxlinux enterprise server for sap applications 15 sp11.34.1-4.9.1fixed
Susebusyboxlinux enterprise server for sap applications 15 sp21.34.1-4.9.1fixed
Susebusyboxmanager proxy 4.11.34.1-4.9.1fixed
Susebusyboxmanager retail branch server 4.11.34.1-4.9.1fixed
Susebusyboxmanager server 4.11.34.1-4.9.1fixed
Susebusyboxenterprise storage 61.34.1-4.9.1fixed
Susebusyboxenterprise storage 71.34.1-4.9.1fixed
Ubuntubusybox14.041:1.20.0-8.1ubuntu1vulnerable
Ubuntubusybox14.041:1.20.0-9ubuntu1vulnerable
Ubuntubusybox14.041:1.20.0-9ubuntu2vulnerable
Ubuntubusybox14.041:1.21.0-1ubuntu1vulnerable
Ubuntubusybox14.041:1.21.0-1ubuntu1.4fixed
Ubuntubusybox16.041:1.22.0-15ubuntu1vulnerable
Ubuntubusybox16.041:1.22.0-15ubuntu1.4fixed
Ubuntubusybox18.041:1.22.0-19ubuntu2vulnerable
Ubuntubusybox18.041:1.27.2-1ubuntu3vulnerable
Ubuntubusybox18.041:1.27.2-1ubuntu4vulnerable
Ubuntubusybox18.041:1.27.2-2ubuntu2vulnerable
Ubuntubusybox18.041:1.27.2-2ubuntu3fixed
Opensusevirtualboxleap 15.36.1.34-lp153.2.27.2fixed
Opensusevirtualbox-kmpleap 15.36.1.34-lp153.2.27.1fixed
Opensusebusyboxleap 15.31.34.1-4.9.1fixed
Opensusebusyboxtumbleweed1.35.0-1.1fixed
Susebusyboxlinux enterprise module for basesystem 15 sp21.26.2-4.5.1fixed
Susebusybox-staticlinux enterprise module for basesystem 15 sp21.26.2-4.5.1fixed
Susebusyboxlinux enterprise module for basesystem 15 sp31.26.2-4.5.1fixed
Susebusybox-staticlinux enterprise module for basesystem 15 sp31.26.2-4.5.1fixed
Susebusyboxlinux enterprise high performance computing 15-espos1.26.2-4.5.1fixed
Susebusyboxlinux enterprise high performance computing 15-ltss1.26.2-4.5.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp1-espos1.26.2-4.5.1fixed
Susebusybox-staticlinux enterprise high performance computing 15 sp1-espos1.26.2-4.5.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp1-ltss1.26.2-4.5.1fixed
Susebusybox-staticlinux enterprise high performance computing 15 sp1-ltss1.26.2-4.5.1fixed
Susebusyboxlinux enterprise server 15-ltss1.26.2-4.5.1fixed
Susebusyboxlinux enterprise server 15 sp1-bcl1.26.2-4.5.1fixed
Susebusybox-staticlinux enterprise server 15 sp1-bcl1.26.2-4.5.1fixed
Susebusyboxlinux enterprise server 15 sp1-ltss1.26.2-4.5.1fixed
Susebusybox-staticlinux enterprise server 15 sp1-ltss1.26.2-4.5.1fixed
Susebusyboxlinux enterprise server for sap applications 151.26.2-4.5.1fixed
Susebusyboxlinux enterprise server for sap applications 15 sp11.26.2-4.5.1fixed
Susebusybox-staticlinux enterprise server for sap applications 15 sp11.26.2-4.5.1fixed
Susebusyboxenterprise storage 61.26.2-4.5.1fixed
Susebusybox-staticenterprise storage 61.26.2-4.5.1fixed
Susebusyboxopenstack cloud 91.35.0-4.3.1fixed
Susebusyboxopenstack cloud crowbar 91.35.0-4.3.1fixed
Susebusyboxlinux enterprise server for sap applications 12 sp41.35.0-4.3.1fixed
Susebusyboxlinux enterprise server 12 sp2-bcl1.35.0-4.3.1fixed
Susebusyboxlinux enterprise server 12 sp3-bcl1.35.0-4.3.1fixed
Susebusyboxlinux enterprise server 12 sp4-ltss1.35.0-4.3.1fixed
Susebusyboxlinux enterprise server 12 sp51.35.0-4.3.1fixed
Susebusyboxlinux enterprise server for sap applications 12 sp51.35.0-4.3.1fixed
Opensusebusyboxleap 15.21.26.2-lp152.5.3.1fixed
Opensusebusybox-staticleap 15.21.26.2-lp152.5.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbusyboxsourcesid1:1.27.2-1not yet assignedNot reported[802702]
Debianbusyboxsourceforky1:1.27.2-1not yet assignedNot reported[802702]
Debianbusyboxsourcetrixie1:1.27.2-1not yet assignedNot reported[802702]
Debianbusyboxsourcebookworm1:1.27.2-1not yet assignedNot reported[802702]
Ubuntubusyboxdeb14.041:1.21.0-1ubuntu1.4Not reportedUSN-3935-1Not reported
Ubuntubusyboxdeb16.041:1.22.0-15ubuntu1.4Not reportedUSN-3935-1Not reported
Ubuntubusyboxdeb18.041:1.27.2-2ubuntu3.2Not reportedUSN-3935-1Not reported
Opensusebusyboxrpmleap 15.31.26.2-4.5.1Not reportedOPENSUSE-SU-2021:3531-1Not reported
Opensusebusybox-staticrpmleap 15.31.26.2-4.5.1Not reportedOPENSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise module for basesystem 15 sp41.35.0-150400.3.3.1Not reportedSUSE-SU-2022:3959-1Not reported
Opensusebusyboxrpmleap 15.41.35.0-150400.3.3.1Not reportedSUSE-SU-2022:3959-1Not reported
Susebusyboxrpmlinux enterprise real time 15 sp21.34.1-4.9.1Not reportedSUSE-SU-2022:0135-2Not reported
Susebusyboxrpmlinux enterprise module for basesystem 15 sp31.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15-espos1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15-ltss1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp1-espos1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp1-ltss1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp2-espos1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp2-ltss1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server 15-ltss1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp1-bcl1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp1-ltss1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp2-bcl1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp2-ltss1.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 151.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 15 sp11.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 15 sp21.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmmanager proxy 4.11.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmmanager retail branch server 4.11.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmmanager server 4.11.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmenterprise storage 61.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Susebusyboxrpmenterprise storage 71.34.1-4.9.1Not reportedSUSE-SU-2022:0135-1Not reported
Ubuntubusyboxdeb14.041:1.21.0-1ubuntu1.4Not reportedUBUNTU-CVE-2011-5325Not reported
Ubuntubusyboxdeb16.041:1.22.0-15ubuntu1.4Not reportedUBUNTU-CVE-2011-5325Not reported
Ubuntubusyboxdeb18.041:1.27.2-2ubuntu3Not reportedUBUNTU-CVE-2011-5325Not reported
Opensusevirtualboxrpmleap 15.36.1.34-lp153.2.27.2Not reportedOPENSUSE-SU-2022:0135-1Not reported
Opensusevirtualbox-kmprpmleap 15.36.1.34-lp153.2.27.1Not reportedOPENSUSE-SU-2022:0135-1Not reported
Opensusebusyboxrpmleap 15.31.34.1-4.9.1Not reportedOPENSUSE-SU-2022:0135-1Not reported
Opensusebusyboxrpmtumbleweed1.35.0-1.1Not reportedOPENSUSE-SU-2024:11738-1Not reported
Susebusyboxrpmlinux enterprise module for basesystem 15 sp21.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmlinux enterprise module for basesystem 15 sp21.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise module for basesystem 15 sp31.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmlinux enterprise module for basesystem 15 sp31.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15-espos1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15-ltss1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp1-espos1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmlinux enterprise high performance computing 15 sp1-espos1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp1-ltss1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmlinux enterprise high performance computing 15 sp1-ltss1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise server 15-ltss1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp1-bcl1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmlinux enterprise server 15 sp1-bcl1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp1-ltss1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmlinux enterprise server 15 sp1-ltss1.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 151.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 15 sp11.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmlinux enterprise server for sap applications 15 sp11.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmenterprise storage 61.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusybox-staticrpmenterprise storage 61.26.2-4.5.1Not reportedSUSE-SU-2021:3531-1Not reported
Susebusyboxrpmopenstack cloud 91.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Susebusyboxrpmopenstack cloud crowbar 91.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 12 sp41.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Susebusyboxrpmlinux enterprise server 12 sp2-bcl1.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Susebusyboxrpmlinux enterprise server 12 sp3-bcl1.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Susebusyboxrpmlinux enterprise server 12 sp4-ltss1.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Susebusyboxrpmlinux enterprise server 12 sp51.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 12 sp51.35.0-4.3.1Not reportedSUSE-SU-2022:4253-1Not reported
Opensusebusyboxrpmleap 15.21.26.2-lp152.5.3.1Not reportedOPENSUSE-SU-2021:1408-1Not reported
Opensusebusybox-staticrpmleap 15.21.26.2-lp152.5.3.1Not reportedOPENSUSE-SU-2021:1408-1Not reported

[Debian bug #802702]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • Source package: [busybox]

    Details (1)
    • 1.38.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.35.0-1.1

      Version impact unknown

      dsa · busybox · opensuse · tumbleweed

  • Source package: [busybox]

    Details (1)
    • 1.38.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.35.0-1.1

      Version impact unknown

      dsa · busybox · opensuse · tumbleweed

  • Source package: [busybox]

    Details (1)
    • 1.38.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.35.0-1.1

      Version impact unknown

      dsa · busybox · opensuse · tumbleweed

  • [busybox]Fixed

    Source package: [busybox]

    Details (1)
    • 1.38.0-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.35.0-1.1

      dsa · busybox · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [busybox]Fixed

    Source package: [busybox]

    Details (2)
    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • Source package: [busybox]

    Details (2)
    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • Source package: [busybox]

    Details (2)
    • 1:1.35.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [udhcpc]Fixed

    Source package: [busybox]

    Details (2)
    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [udhcpd]Fixed

    Source package: [busybox]

    Details (2)
    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

[Debian 13 (Trixie)]

  • [busybox]Fixed

    Source package: [busybox]

    Details (2)
    • 1:1.37.0-6+b8 · amd64 · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

    • 1:1.37.0-6+b8 · arm64 · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

  • Source package: [busybox]

    Details (2)
    • 1:1.37.0-6+b8 · amd64 · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

    • 1:1.37.0-6+b8 · arm64 · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

  • Source package: [busybox]

    Details (2)
    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

  • [udhcpc]Fixed

    Source package: [busybox]

    Details (2)
    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

  • [udhcpd]Fixed

    Source package: [busybox]

    Details (2)
    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.27.2-1

      dsa · busybox · debian · 13

Observed:

References