CVE-2005-1918

CVE Descriptions

The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	2.6		AV:N/AC:H/Au:N/C:N/I:P/A:N	nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	2.69%	–	–
2022-04-03	–	–	2.69%	–	–
2022-06-12	–	–	2.69%	–	–
2023-02-26	–	–	2.69%	–	–
2023-03-12	–	–	–	0.11%	–
2023-03-26	–	–	–	0.11%	–
2023-10-29	–	–	–	0.11%	–
2023-12-03	–	–	–	0.11%	–
2023-12-24	–	–	–	0.11%	–
2024-01-07	–	–	–	0.11%	–
2024-01-28	–	–	–	0.11%	–
2024-02-11	–	–	–	0.11%	–
2024-02-25	–	–	–	0.11%	–
2024-06-02	–	–	–	0.11%	–
2024-08-25	–	–	–	0.11%	–
2024-12-15	–	–	–	0.11%	–
2024-12-22	–	–	–	0.08%	–
2025-01-19	–	–	–	0.08%	–
2025-01-26	–	–	–	0.08%	–
2025-02-02	–	–	–	0.06%	–
2025-01-19	–	–	–	0.08%	–
2025-01-25	–	–	–	0.08%	–
2025-02-02	–	–	–	0.06%	–
2025-03-18	–	–	–	–	1.71%
2025-03-30	–	–	–	–	1.99%
2025-04-15	–	–	–	–	1.99%
2025-04-15	–	–	–	–	1.99,%

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Date	Percentile
2022-02-06	63%
2022-04-03	81%
2022-06-12	82%
2023-02-26	83%
2023-03-12	42%
2023-03-26	43%
2023-10-29	44%
2023-12-03	43%
2023-12-24	44%
2024-01-07	43%
2024-01-28	44%
2024-02-11	42%
2024-02-25	43%
2024-06-02	44%
2024-08-25	45%
2024-12-15	46%
2024-12-22	35%
2025-01-19	35%
2025-01-26	36%
2025-02-02	28%
2025-01-19	35%
2025-01-25	36%
2025-02-02	28%
2025-03-18	81%
2025-03-30	82%
2025-04-15	83%
2025-04-15	83%