Mandriva Linux Security Advisory : cpio (MDVSA-2015:065)

Updated cpio package fixes security vulnerabilities : Heap-based buffer overflow in the processcopyin function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive CVE-2014-9112. Additionally, a NULL pointer dereference in the copyinlink...

cpio -- multiple vulnerabilities

From the Debian Security Team: Heap-based buffer overflow in the processcopyin function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitra...

Debian DLA-111-1 : cpio security update

Multiple issues have been identified in cpio, including a buffer overflow and multiple NULL pointer dereference, resulting at least in a denial of service and possibly also in an unwanted code execution. This has been fixed in Debian 6 Squeeze with version 2.11-4+deb6u1 by applying the upstream...

cpio: directory traversal

It was reported that cpio is vulnerable to a directory traversal vulnerability when using the --no-absolute-filenames option. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write to...

Mandriva Linux Security Advisory : rpm (MDVSA-2015:056)

Updated rpm packages fix security vulnerabilities : It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system...

DEBIAN-CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

Code injection

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

MGASA-2015-0080 Updated cpio package fixes security vulnerability

In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries...

Updated cpio package fixes security vulnerability

In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries...

UBUNTU-CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

PT-2015-7879

Name of the Vulnerable Software and Affected Versions GNU Cpio version 2.11 Description The issue allows a rogue archive to write files outside the current directory by bypassing the --no-absolute-filenames option using symlinks. While extracting an archive, GNU Cpio will extract symlinks and the...

CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

CVE-2015-1197

The CVE-2015-1197 issue affects cpio 2.11, where using --no-absolute-filenames enables a local user to write to arbitrary files via a symlink attack on an archive entry (path traversal). Connected sources confirm this vulnerability and describe upstream fixes to --no-absolute-filenames in later c...

CVE-2015-1197: Undefined Security Weakness

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

PT-2015-5159

Name of the Vulnerable Software and Affected Versions cpio version 2.11 Description The issue allows local users to write to arbitrary files via a symlink attack on a file in an archive when the --no-absolute-filenames option is used. Recommendations For cpio version 2.11, avoid using the...

CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive...

RPM Package Manager CPIO Header NameSize Integer Overflow (CVE-2014-8118)

A code execution vulnerability exists in RPM package manager. The vulnerability is due to an integer overflow when parsing the CPIO header in the payload section of an RPM file, leading to a stack buffer overflow. A remote attacker can exploit this vulnerability by enticing a user to install a...