CVE-2023-7207

CVE-2023-7207 affects Debian/Ubuntu CPIO and is caused by reverting patches to --no-absolute-filenames that reintroduced a path-traversal weakness. Upstream has provided a proper fix to --no-absolute-filenames. Evidence in connected advisories confirms the issue as a cpio path traversal vulnerabi...

CVE-2005-1229

CPIO (GNU cpio) prior to version 2.6 is affected by CVE-2005-1229, a directory-traversal flaw that lets an attacker write to arbitrary directories during extraction via a .. path in an archive. The root cause is that cpio does not sanitise extracted paths (even with --no-absolute-filenames). Cons...

CVE-2005-1111

Summary (CVE-2005-1111 family) : The cpio utility (2.6 and earlier) is affected by a local race condition when extracting or creating files, allowing a local attacker with write access to the target directory to modify the permissions of files being created or extracted. Related issues include im...