cve-2022-41352-zimbra-rce

CVE-2022-41352 Zimbra Unauthenticated RCE CVE-2022-41352 is an arbitrary file write vulnerability in Zimbra mail servers due to the use of a vulnerable cpio version. CVE-2022-41352 NIST.gov CVE-2022-41352 Rapid7 Analysis AffectedZimbra versions: Zimbra 9.0.0.p27 Zimbra 8.8.15.p34 Refer to the pat...

cpiopwn

cpiopwn CVE-2021-38185 This is an ACE POC of an integer overflow bug in cpio. This exploit bypasses all binary protections except full RELRO. This exploit uses cpio 2.13 and libc 2.31. Video demo: https://youtu.be/F0yKJhu7Vak Running the exploit We've provided a Kali Dockerfile to run the exploit...

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

cve-2022-41352

cve-2022-41352 generate poc.tar $ chmod +x cpiopocgen.py $ ./cpiopocgen.py show the middle finger to cpio $ cd /tmp $ mkdir -p poc/a/b copy poc.tar to /tmp/poc/a/b/ $ cd /tmp/poc/a/b/ $ cpio -i poc.tar $ ls -al ../ total 16 drwxrwxr-x 3 xabino xabino 4096 ott 10 14:56 . drwxrwxr-x 3 xabino xabino...

CentOS Linux 7 [TuxCare] Security Update: cpio (CENTOS7:CLSA-2024:1712672449)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1712672449 advisory. - GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow...

Rocky Linux 8 [CIQ] Security Update: cpio / cpio-debuginfo / cpio-debugsource (crlsa-2021_1582)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211582 advisory. cpio: improper input validation when writing tar header fields leads to unexpected tar generation CVE-2019-14866 Tenable has extracted the preceding description blo...

Rocky Linux 9.6 [TuxCare] Security Update: cpio (ALMALINUX9.6:CLSA-2026:1786621771)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786621771 advisory. - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a...

AlmaLinux 9.2 [TuxCare] Security Update: cpio (ALMALINUX9.2:CLSA-2026:1786620962)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786620962 advisory. - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a...

AlmaLinux 9.6 [TuxCare] Security Update: cpio (ALMALINUX9.6:CLSA-2026:1786621771)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786621771 advisory. - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a...

Rocky Linux 8 [CIQ] Security Update: cpio / cpio-debuginfo / cpio-debugsource (crlsa-2022_1991)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221991 advisory. cpio: integer overflow in dsfgetstr in dstring.c can lead to an out-of-bounds write via a crafted pattern file CVE-2021-38185 Tenable has extracted the preceding...

CLEANSTART-2024-DL67749 cpio_safer_name_suffix function in util

Security vulnerability affects the cpio package. The cpiosafernamesuffix function in util...

CLEANSTART-2024-VM66641 In all versions of cpio before 2

Security vulnerability affects the cpio package. In all versions of cpio before 2...

CLEANSTART-2024-DM54959 cpio 2

Security vulnerability affects the cpio package. cpio 2...

CLEANSTART-2024-HF57565 GNU cpio through 2

Security vulnerability affects the cpio package. GNU cpio through 2...

AlmaLinux 9.2 [TuxCare] Security Update: cpio Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787337004)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787337004 advisory. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca t...

Rocky Linux 9.6 [TuxCare] Security Update: cpio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787310466)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787310466 advisory. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca...

AlmaLinux 9.6 [TuxCare] Security Update: cpio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787310466)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787310466 advisory. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca t...

MGASA-2026-0435 Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

SUSE SLED15 / SLES15 Security Update : cpio (SUSE-SU-2026:4012-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4012-1 advisory. - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of...