TI-2023-06601 CVE-2023-7216 · GHSA-v9vx-4mxw-76j2
Cpio: extraction allows symlinks which enables remote command execution
Priority MEDIUM 59
A path traversal vulnerability was found in the CPIO utility.
Vulnerabilities
12 records
TI-2023-06592 CVE-2023-7207 · GHSA-x4gq-xcr8-xwp7
Path traversal in Debian cpio
Priority LOW 24
Debian's cpio contains a path traversal vulnerability.
TI-2021-15862 CVE-2021-38185 · GHSA-pp74-ghrg-jwfh
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern…
Priority MEDIUM 43
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write.
TI-2019-11070 CVE-2019-14866 · GHSA-g3pr-277r-xcx7
Improper input validation in Red Hat cpio
Priority LOW 33
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
TI-2016-01868 CVE-2016-2037 · GHSA-g3qq-8w29-572m
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to…
Priority LOW 37
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.
TI-2015-01078 CVE-2015-1197 · GHSA-447h-6vgc-mg6p
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to…
Priority LOW 18
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
TI-2014-07398 CVE-2014-9112 · GHSA-wvrh-73qw-9vj9
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote…
Priority LOW 33
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.
TI-2010-03976 CVE-2010-4226 · GHSA-mwc7-wm76-6x7w
cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote…
Priority LOW 39
cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive.
TI-2010-00595 CVE-2010-0624 · GHSA-27jj-5xgw-m6qw
Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client…
Priority LOW 38
Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corru…
TI-2005-04012 CVE-2005-4268 · GHSA-gf47-4488-9gh6
Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive…
Priority LOW 18
Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a file whose size is represented by mor…
TI-2005-01164 CVE-2005-1229 · GHSA-g564-fjp3-fqpr
Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to…
Priority LOW 25
Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a ..
TI-2005-01049 CVE-2005-1111 · GHSA-fg93-983g-7p2v
Race condition in cpio 2.6 and earlier allows local users to modify permissions of…
Priority LOW 21
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompre…