Security readout for executives and security teams
CVE-2007-4476 is a reported buffer overflow in GNU tar. The public record says the attack vector and full impact are unspecified, with a “crashing stack” result. Treat it as a legacy package risk: low urgency for modern managed systems, but worth closing on old Unix/Linux estates. Exposure is most plausible on legacy systems running old GNU tar packages from circa 2007 or older OS baselines. The bundle does not identify exact affected versions, so exposure should be confirmed against vendor advisories and package metadata. Set this as a legacy hygiene item unless vulnerable old systems are still business-critical. The main risk is uncertainty: the public record lacks impact detail, but vendor advisories indicate real package remediation was issued. Mitigation focus: Check the relevant OS vendor advisory for fixed GNU tar package versions.; Upgrade GNU tar through supported vendor packages where affected.; Prioritize unsupported or long-lived legacy Unix/Linux systems for review..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2007-4476 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- FEDORA-2007-2673CVE reference · vendor-advisory, x_refsource_FEDORA
- oval:org.mitre.oval:def:8599CVE reference · vdb-entry, signature
- https://issues.rpath.com/browse/RPL-1861CVE reference · x_refsource_CONFIRM
- FEDORA-2007-735CVE reference · vendor-advisory, x_refsource_FEDORA
- oval:org.mitre.oval:def:9336CVE reference · vdb-entry, signature
- oval:org.mitre.oval:def:7114CVE reference · vdb-entry, signature
- https://bugzilla.redhat.com/show_bug.cgi?id=280961CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.