Description
Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a file whose size is represented by more than 8 digits.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpio | 2.6-10 | — |
| Debian 13 | cpio | 2.6-10 | — |
| Debian 12 | cpio | 2.6-10 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cpio | 2.5-13.RHEL4 | RHSA-2007:0245 |
| RHEL 3 | cpio | 2.5-6.RHEL3 | RHSA-2010:0145 |
Advisories 2
- RHSA-2010:0145 Red Hat Security Advisory: cpio security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0245 Red Hat Security Advisory: cpio security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 25098 third-party-advisory
- RHSA-2007:0245 vendor-advisory
- 25161 third-party-advisory
- cpio-file-size-bo(23855) vdb-entry
- https://issues.rpath.com/browse/RPL-1338
- 18280 third-party-advisory
- 22194 vdb-entry
- MDKSA-2005:237 vendor-advisory
- oval:org.mitre.oval:def:6860 vdb-entry signature
- RHSA-2010:0145 vendor-advisory
- SUSE-SR:2006:010 vendor-advisory
- 20117 third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=172669
- oval:org.mitre.oval:def:10450 vdb-entry signature
- 16057 vdb-entry
- 18278 third-party-advisory
- 18395 third-party-advisory
- 18251 third-party-advisory
- USN-234-1 vendor-advisory