Medium USN-4176-1 1 CVE

cpio vulnerability

Published Nov 6, 2019 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Thomas Habets discovered that GNU cpio incorrectly handled certain inputs.
An attacker could possibly use this issue to privilege escalation.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	cpio	2.11+dfsg-5ubuntu1.1
Ubuntu · 18.04 LTS 18.04:LTS	cpio	2.12+dfsg-6ubuntu0.18.04.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	cpio	2.11+dfsg-1ubuntu1.2+esm1

Vulnerabilities 1

Medium 6.7

CVE-2019-14866

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is u…

Red Hat cpio cpio cpio Debian Ubuntu Alpine

Jan 7, 2020

References

report
https://ubuntu.com/security/CVE-2019-14866