AlmaLinux 9.2 [TuxCare] Security Update: cpio Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787337004)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787337004 advisory. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca t...

AlmaLinux 9.6 [TuxCare] Security Update: cpio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787310466)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787310466 advisory. - GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca t...

Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

MGASA-2026-0435 Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

USN-8704-1: GNU cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...

OESA-2026-3540 cpio security update

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fixes: GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: cpio (UTSA-2025-002289)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002289 advisory. GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an...

TencentOS Server 4: cpio (TSSA-2026:0856)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0856 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

OESA-2026-3456 cpio security update

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fixes: GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the...

cpio: GNU cpio: Path Traversal allows creating hard links outside intended directory via malicious tar archives.

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

SUSE CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

SUSE CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

SUSE CVE-2026-66486

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

CVE-2026-66486

A flaw was found in GNU cpio. This vulnerability occurs in the archive member listing functionality, where member names are printed directly without proper encoding or escaping. A remote attacker could craft a malicious cpio archive containing specially designed member names with embedded newline...

CVE-2026-66485

A flaw was found in GNU cpio. This vulnerability involves uncontrolled memory allocation when processing specially crafted cpio archives. A remote attacker could exploit this by providing a malicious archive, leading to a stack overflow and causing the cpio process to crash. This results in a...

CVE-2026-66484

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

AZL-94695 CVE-2026-66484 affecting package cpio for versions less than 2.14-2

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

DEBIAN-CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

CVE-2026-66486

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...