CVE-2019-14866

CVE-2019-14866 affects GNU cpio: all versions before 2.13 improperly validate input when generating TAR archives, enabling a local attacker to cause files with unintended permissions or paths when creating archives. Exploitation relies on archiving from paths, potentially enabling high-privilege ...

CVE-2010-4226

The cpio utility, specifically in build versions 2007.05.10 and 2010.07.28 , is vulnerable to a flaw that allows remote attackers to overwrite arbitrary files via a symlink contained within an RPM package archive . To remediate this, the build script was updated to use bsdtar instead of cpio for ...