GLSA-201502-11 : GNU cpio: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201502-11 GNU cpio: Multiple vulnerabilities Two vulnerabilities have been discovered in GNU cpio: The listfile function in GNU cpio contains a heap-based buffer overflow vulnerability CVE-2014-9112 A directory traversal...

GNU cpio: Multiple vulnerabilities

Background GNU cpio copies files into or out of a cpio or tar archive. Description Two vulnerabilities have been discovered in GNU cpio: The listfile function in GNU cpio contains a heap-based buffer overflow vulnerability CVE-2014-9112 A directory traversal vulnerability has been found in GNU cp...

Ubuntu: Security Advisory (USN-2456-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cpio Symbolic Link Directory Traversal Vulnerability

The GNU Coreutils are the basic file, shell and text manipulation tools used by the GNU operating system. A symbolic link directory traversal vulnerability exists in Cpio, which allows an attacker to access file directories to obtain sensitive information and perform other attacks...

Ubuntu 14.04 LTS : RPM vulnerabilities (USN-2479-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2479-1 advisory. Florian Weimer discovered that RPM incorrectly handled temporary files. A local attacker could use this issue to execute arbitrary code. CVE-2013-6435...

USN-2479-1 rpm vulnerabilities

Florian Weimer discovered that RPM incorrectly handled temporary files. A local attacker could use this issue to execute arbitrary code. CVE-2013-6435 Florian Weimer discovered that RPM incorrectly handled certain CPIO headers. If a user or automated system were tricked into installing a maliciou...

Debian Security Advisory DSA 3129-1 (rpm - security update)

Two vulnerabilities have been discovered in the RPM package manager. CVE-2013-6435 Florian Weimer discovered a race condition in package signature validation. CVE-2014-8118 Florian Weimer discovered an integer overflow in parsing CPIO headers which might result in the execution of arbitrary code...

cpio: heap buffer overflow

A heap-based buffer overflow flaw was reported in cpio's listfile function. Attempting to extract a malicious cpio archive could cause cpio to crash or, potentially, execute arbitrary code. As noted in the original report, this issue could be trigger via other utilities, such as when running "les...

Ubuntu 14.04 LTS : GNU cpio vulnerabilities (USN-2456-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2456-1 advisory. Michal Zalewski discovered an out of bounds write issue in the processcopyin function of GNU cpio. An attacker could specially craft a cpio archive that...

USN-2456-1: GNU cpio vulnerabilities

Michal Zalewski discovered an out of bounds write issue in the processcopyin function of GNU cpio. An attacker could specially craft a cpio archive that could create a denial of service or possibly execute arbitrary code. CVE-2014-9112 Jakob Lell discovered a heap-based buffer overflow in the...

USN-2456-1 cpio vulnerabilities

Michal Zalewski discovered an out of bounds write issue in the processcopyin function of GNU cpio. An attacker could specially craft a cpio archive that could create a denial of service or possibly execute arbitrary code. CVE-2014-9112 Jakob Lell discovered a heap-based buffer overflow in the...

Fedora 20 : cpio-2.11-28.fc20 (2014-16250)

Security fix for CVE-2014-9112 1167573 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora Update for cpio FEDORA-2014-16168

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : rpm-4.11.3-2.fc20 (2014-16838)

Add check against malicious CPIO file name size - Fix race condidition where unchecked data is exposed in the file system Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Debian DSA-3111-1 : cpio - security update

Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and NULL pointer dereference issues. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] [DSA 3111-1] cpio security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3111-1 [email protected] http://www.debian.org/security/ Michael Gilbert December 22, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3111-1] cpio security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3111-1 [email protected] http://www.debian.org/security/ Michael Gilbert December 22, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3111-1 (cpio - security update)

Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and null pointer dereference issues. OpenVAS Vulnerability Test $Id:...

SuSE 11.3 Security Update : cpio (SAT Patch Number 10070)

This cpio update fixes the following security issue : - heap-based buffer overflow flaw in listfile CVE-2014-9112. bnc907456 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself ...

[ MDVSA-2014:250 ] cpio

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:250 http://www.mandriva.com/en/support/security/ Package : cpio Date : December 14, 2014 Affected: Business Server 1.0 Problem Description: Updated cpio package fixes security vulnerability: Heap-based buffe...