cpio

15 results · Feed

• Medium 4.6
  CVE-2026-66486

  Improper Output Encoding in GNU cpio

  GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio arc…

  GNU cpio cpio cpio Debian Ubuntu
  Aug 10, 2026
• Medium 4.6
  CVE-2026-66485

  Uncontrolled Memory Allocation in GNU cpio

  GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. …

  GNU cpio cpio cpio Debian Ubuntu
  Aug 10, 2026
• Medium 4.6
  CVE-2026-66484

  Path Traversal in GNU cpio

  GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed t…

  GNU cpio cpio cpio Debian Ubuntu
  Aug 10, 2026
• Medium 4.9
  CVE-2023-7207

  Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches whi…

  Debian Debian cpio cpio cpio Debian Ubuntu
  Jan 5, 2024
• High 7.8
  CVE-2021-38185 Public exploit

  GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_…

  cpio cpio cpio Debian Ubuntu Alpine
  Aug 7, 2021
• Medium 6.7
  CVE-2019-14866

  In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is u…

  Red Hat cpio cpio cpio Debian Ubuntu Alpine
  Jan 7, 2020
• Unscored —
  CVE-2016-2037

  The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of…

  cpio cpio cpio Debian Ubuntu Alpine
  Feb 22, 2016
• Unscored —
  CVE-2015-1197

  cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink …

  cpio cpio cpio Debian Ubuntu Alpine
  Feb 19, 2015
• Unscored —
  CVE-2014-9112

  Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial o…

  cpio cpio Debian Ubuntu
  Dec 2, 2014
• Unscored —
  CVE-2010-0624

  Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar befo…

  tar cpio Debian
  Mar 12, 2010
• Unscored —
  CVE-2007-4476 Public exploit EPSS 15%

  Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a …

  tar cpio Debian
  Sep 5, 2007
• Unscored —
  CVE-2005-4268

  Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local users to cause a deni…

  cpio Debian
  Dec 15, 2005
• Unscored —
  CVE-2005-1229

  Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via…

  cpio Debian
  Apr 22, 2005
• Unscored —
  CVE-2005-1111

  Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link atta…

  cpio Debian
  Apr 16, 2005
• Unscored —
  CVE-1999-1572

  cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files u…

  cpio Debian
  Jan 29, 2005