Read the docs
TI-2010-00595 Aliases CVE-2010-0624GHSA-27jj-5xgw-m6qw

Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client…

Priority LOW 38CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (colon) character.

Why it matters now

EPSS 0.04747 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*up to 2.10VulnerableGNU
cpe:2.3:a:gnu:cpio:1.0:*:*:*:*:*:*:*1.0VulnerableGNU
cpe:2.3:a:gnu:cpio:1.1:*:*:*:*:*:*:*1.1VulnerableGNU
cpe:2.3:a:gnu:cpio:1.2:*:*:*:*:*:*:*1.2VulnerableGNU
cpe:2.3:a:gnu:cpio:1.3:*:*:*:*:*:*:*1.3VulnerableGNU
cpe:2.3:a:gnu:cpio:2.4-2:*:*:*:*:*:*:*2.4-2VulnerableGNU
cpe:2.3:a:gnu:cpio:2.5:*:*:*:*:*:*:*2.5VulnerableGNU
cpe:2.3:a:gnu:cpio:2.5.90:*:*:*:*:*:*:*2.5.90VulnerableGNU
cpe:2.3:a:gnu:cpio:2.6:*:*:*:*:*:*:*2.6VulnerableGNU
cpe:2.3:a:gnu:cpio:2.7:*:*:*:*:*:*:*2.7VulnerableGNU
  • cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* Versions up to 2.10 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:2.4-2:*:*:*:*:*:*:* Versions 2.4-2 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:2.5.90:*:*:*:*:*:*:* Versions 2.5.90 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·GNU
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnu:cpio:2.8:*:*:*:*:*:*:*2.8VulnerableGNU
cpe:2.3:a:gnu:cpio:2.9:*:*:*:*:*:*:*2.9VulnerableGNU
cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:*up to 1.22VulnerableGNU
cpe:2.3:a:gnu:tar:1.13:*:*:*:*:*:*:*1.13VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.5:*:*:*:*:*:*:*1.13.5VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.11:*:*:*:*:*:*:*1.13.11VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.14:*:*:*:*:*:*:*1.13.14VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.16:*:*:*:*:*:*:*1.13.16VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.17:*:*:*:*:*:*:*1.13.17VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.18:*:*:*:*:*:*:*1.13.18VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.19:*:*:*:*:*:*:*1.13.19VulnerableGNU
cpe:2.3:a:gnu:tar:1.13.25:*:*:*:*:*:*:*1.13.25VulnerableGNU
cpe:2.3:a:gnu:tar:1.14:*:*:*:*:*:*:*1.14VulnerableGNU
cpe:2.3:a:gnu:tar:1.14.1:*:*:*:*:*:*:*1.14.1VulnerableGNU
cpe:2.3:a:gnu:tar:1.14.90:*:*:*:*:*:*:*1.14.90VulnerableGNU
cpe:2.3:a:gnu:tar:1.15:*:*:*:*:*:*:*1.15VulnerableGNU
cpe:2.3:a:gnu:tar:1.15.1:*:*:*:*:*:*:*1.15.1VulnerableGNU
cpe:2.3:a:gnu:tar:1.15.90:*:*:*:*:*:*:*1.15.90VulnerableGNU
cpe:2.3:a:gnu:tar:1.15.91:*:*:*:*:*:*:*1.15.91VulnerableGNU
cpe:2.3:a:gnu:tar:1.16:*:*:*:*:*:*:*1.16VulnerableGNU
cpe:2.3:a:gnu:tar:1.16.1:*:*:*:*:*:*:*1.16.1VulnerableGNU
cpe:2.3:a:gnu:tar:1.17:*:*:*:*:*:*:*1.17VulnerableGNU
cpe:2.3:a:gnu:tar:1.18:*:*:*:*:*:*:*1.18VulnerableGNU
cpe:2.3:a:gnu:tar:1.19:*:*:*:*:*:*:*1.19VulnerableGNU
cpe:2.3:a:gnu:tar:1.20:*:*:*:*:*:*:*1.20VulnerableGNU
cpe:2.3:a:gnu:tar:1.21:*:*:*:*:*:*:*1.21VulnerableGNU
  • cpe:2.3:a:gnu:cpio:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·GNU
  • cpe:2.3:a:gnu:cpio:2.9:*:*:*:*:*:*:* Versions 2.9 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:*:*:*:*:*:*:*:* Versions up to 1.22 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.5:*:*:*:*:*:*:* Versions 1.13.5 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.11:*:*:*:*:*:*:* Versions 1.13.11 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.14:*:*:*:*:*:*:* Versions 1.13.14 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.16:*:*:*:*:*:*:* Versions 1.13.16 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.17:*:*:*:*:*:*:* Versions 1.13.17 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.18:*:*:*:*:*:*:* Versions 1.13.18 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.19:*:*:*:*:*:*:* Versions 1.13.19 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.13.25:*:*:*:*:*:*:* Versions 1.13.25 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.14.1:*:*:*:*:*:*:* Versions 1.14.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.14.90:*:*:*:*:*:*:* Versions 1.14.90 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15.1:*:*:*:*:*:*:* Versions 1.15.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15.90:*:*:*:*:*:*:* Versions 1.15.90 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.15.91:*:*:*:*:*:*:* Versions 1.15.91 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.16.1:*:*:*:*:*:*:* Versions 1.16.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.17:*:*:*:*:*:*:* Versions 1.17 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.18:*:*:*:*:*:*:* Versions 1.18 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.19:*:*:*:*:*:*:* Versions 1.19 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.20:*:*:*:*:*:*:* Versions 1.20 Vulnerable ·GNU
  • cpe:2.3:a:gnu:tar:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·GNU

Remediation

Red Hat 5 advisories

  • RHSA-2010:0145 Released 2010-03-16 · Red Hat rating Moderate
    cpio security update
    • Red Hat Desktop version 3 cpio-2.5-6.RHEL3, cpio-2.5-6.RHEL3.i386
    • Red Hat Enterprise Linux AS version 3 cpio-2.5-6.RHEL3, cpio-2.5-6.RHEL3.i386, cpio-2.5-6.RHEL3.ia64 +1
    • Red Hat Enterprise Linux ES version 3 cpio-2.5-6.RHEL3, cpio-2.5-6.RHEL3.i386, cpio-2.5-6.RHEL3.ia64
    • Red Hat Enterprise Linux WS version 3 cpio-2.5-6.RHEL3, cpio-2.5-6.RHEL3.i386, cpio-2.5-6.RHEL3.ia64
  • RHSA-2010:0144 Released 2010-03-16 · Red Hat rating Moderate
    cpio security update
    • Red Hat Enterprise Linux (v. 5 server) cpio-2.6-23.el5_4.1, cpio-2.6-23.el5_4.1.i386, cpio-2.6-23.el5_4.1.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) cpio-2.6-23.el5_4.1, cpio-2.6-23.el5_4.1.i386
  • RHSA-2010:0143 Released 2010-03-16 · Red Hat rating Moderate
    cpio security update
    • Red Hat Enterprise Linux AS version 4 cpio-2.5-16.el4_8.1, cpio-2.5-16.el4_8.1.i386, cpio-2.5-16.el4_8.1.ia64 +1
    • Red Hat Enterprise Linux Desktop version 4 cpio-2.5-16.el4_8.1, cpio-2.5-16.el4_8.1.i386
    • Red Hat Enterprise Linux ES version 4 cpio-2.5-16.el4_8.1, cpio-2.5-16.el4_8.1.i386, cpio-2.5-16.el4_8.1.ia64
    • Red Hat Enterprise Linux WS version 4 cpio-2.5-16.el4_8.1, cpio-2.5-16.el4_8.1.i386, cpio-2.5-16.el4_8.1.ia64
Show 2 more Red Hat advisories
  • RHSA-2010:0142 Released 2010-03-16 · Red Hat rating Moderate
    tar security update
    • Red Hat Desktop version 3 tar-1.13.25-16.RHEL3, tar-1.13.25-16.RHEL3.i386
    • Red Hat Enterprise Linux AS version 3 tar-1.13.25-16.RHEL3, tar-1.13.25-16.RHEL3.i386, tar-1.13.25-16.RHEL3.ia64 +1
    • Red Hat Enterprise Linux ES version 3 tar-1.13.25-16.RHEL3, tar-1.13.25-16.RHEL3.i386, tar-1.13.25-16.RHEL3.ia64
    • Red Hat Enterprise Linux WS version 3 tar-1.13.25-16.RHEL3, tar-1.13.25-16.RHEL3.i386, tar-1.13.25-16.RHEL3.ia64
  • RHSA-2010:0141 Released 2010-03-15 · Red Hat rating Moderate
    tar security update
    • Red Hat Enterprise Linux (v. 5 server) tar-2:1.15.1-23.0.1.el5_4.2, tar-2:1.15.1-23.0.1.el5_4.2.i386, tar-2:1.15.1-23.0.1.el5_4.2.ia64 +1
    • Red Hat Enterprise Linux AS version 4 tar-1.14-13.el4_8.1, tar-1.14-13.el4_8.1.i386, tar-1.14-13.el4_8.1.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) tar-2:1.15.1-23.0.1.el5_4.2, tar-2:1.15.1-23.0.1.el5_4.2.i386
    • Red Hat Enterprise Linux Desktop version 4 tar-1.14-13.el4_8.1, tar-1.14-13.el4_8.1.i386
    • Red Hat Enterprise Linux ES version 4 tar-1.14-13.el4_8.1, tar-1.14-13.el4_8.1.i386, tar-1.14-13.el4_8.1.ia64
    • Red Hat Enterprise Linux WS version 4 tar-1.14-13.el4_8.1, tar-1.14-13.el4_8.1.i386, tar-1.14-13.el4_8.1.ia64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2010:0142, RHSA-2010:0145
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2010:0141, RHSA-2010:0144
Red Hat Enterprise Linux AS version 3Fixed RHSA-2010:0142, RHSA-2010:0145
Red Hat Enterprise Linux AS version 4Fixed RHSA-2010:0141, RHSA-2010:0143
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2010:0141, RHSA-2010:0144
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2010:0141, RHSA-2010:0143
Red Hat Enterprise Linux ES version 3Fixed RHSA-2010:0142, RHSA-2010:0145
Red Hat Enterprise Linux ES version 4Fixed RHSA-2010:0141, RHSA-2010:0143
Red Hat Enterprise Linux WS version 3Fixed RHSA-2010:0142, RHSA-2010:0145
Red Hat Enterprise Linux WS version 4Fixed RHSA-2010:0141, RHSA-2010:0143

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-0624
  2. 2026-10-03 Alias added: GHSA-27jj-5xgw-m6qw

References

Exploit 1

Patch 1

Advisory 13

Other 13

  • TI-2023-06601 Cpio: extraction allows symlinks which enables remote command execution CVSS 3.1MEDIUM 5.3
  • TI-2021-15862 GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern… CVSS 3.1HIGH 7.8
  • TI-2010-03976 cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote… CVSS 3.1HIGH 7.2
  • TI-2016-01868 The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to… CVSS 3.0MEDIUM 6.5
  • TI-2019-11070 Improper input validation in Red Hat cpio CVSS 3.1HIGH 7.3
  • TI-2014-07398 Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote… CVSS 2.0MEDIUM 5.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences