Input validation

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have...

CVE-2019-14866

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have...

CVE-2019-14866

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have...

CVE-2019-14866

CVE-2019-14866 affects GNU cpio: all versions before 2.13 improperly validate input when generating TAR archives, enabling a local attacker to cause files with unintended permissions or paths when creating archives. Exploitation relies on archiving from paths, potentially enabling high-privilege ...

EulerOS 2.0 SP8 : cpio (EulerOS-SA-2020-1002)

According to the version of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - cpio does not properly validate the values written in the header of a TAR file through the tooct function. When creating a TAR file from a list of fil...

EulerOS 2.0 SP5 : cpio (EulerOS-SA-2019-2687)

According to the version of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered cpio does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an...

openSUSE Security Update : cpio (openSUSE-2019-2596)

This update for cpio fixes the following issues : - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : cpio (openSUSE-2019-2593)

This update for cpio fixes the following issues : - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. This update was imported from the SUSE:SLE-15:Update update...

openSUSE: Security Advisory for cpio (openSUSE-SU-2019:2593-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:2596-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. This update was imported from the SUSE:SLE-15:Update update...

OPENSUSE-SU-2019:2593-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. This update was imported from the SUSE:SLE-15:Update update...

Security update for cpio (moderate)

openSUSE Security Update: Security update for cpio Announcement ID: openSUSE-SU-2019:2593-1 Rating: moderate References: 1155199 Cross-References: CVE-2019-14866 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This update for cpio fixes...

Security update for cpio (moderate)

openSUSE Security Update: Security update for cpio Announcement ID: openSUSE-SU-2019:2596-1 Rating: moderate References: 1155199 Cross-References: CVE-2019-14866 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for cpio fixes...

SUSE SLED15 / SLES15 Security Update : cpio (SUSE-SU-2019:3059-1)

This update for cpio fixes the following issues : CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. Note that Tenable Network Security has extracted the preceding...

SUSE SLED12 / SLES12 Security Update : cpio (SUSE-SU-2019:3064-1)

This update for cpio fixes the following issues : CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. Note that Tenable Network Security has extracted the preceding...

SUSE-SU-2019:3064-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199...

SUSE-SU-2019:3059-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199...

USN-4176-1: GNU cpio vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. CVEs contained in this USN...

FreeBSD : GNU cpio -- multiple vulnerabilities (f59af308-07f3-11ea-8c56-f8b156b6dcc8)

Sergey Poznyakoff reports : This stable release fixes several potential vulnerabilities CVE-2015-1197: cpio, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. CVE-2016-2037: The cpiosafernamesuffix function ...

Updated cpio packages fix security vulnerabilities

in cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive CVE-2015-1197. Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to privilege...