Description
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpio | 2.11+dfsg-4 | — |
| Debian 13 | cpio | 2.11+dfsg-4 | — |
| Debian 12 | cpio | 2.11+dfsg-4 | — |
| Debian 7 | cpio | 2.11+dfsg-0.1+deb7u1 | DSA-3111-1 |
| Debian 6.0 | cpio | 2.11-4+deb6u1 | DLA-111-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | cpio | 2.11+dfsg-1ubuntu1.1 | USN-2456-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | cpio | 2.11-24.el7 | RHSA-2015:2108 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cpio | 2.12-3.90 | openSUSE-SU-2024:10143-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | cpio | 2.11-24.el7 | ELSA-2015-2108 |
Advisories 6
- RHSA-2015:2108 Red Hat Security Advisory: cpio security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-3111-1 cpio - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-111-1 cpio - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2456-1 cpio vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10143-1 cpio-2.12-3.90 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-2108 Moderate: cpio security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 23, 2015
References
- 62145 third-party-advisory
- 60167 third-party-advisory
- linux-kernel-lesspipe-code-exec(98918) vdb-entry
- 71248 vdb-entry
- 20141123 on Linux, 'less' can probably get you owned mailing-list
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- https://savannah.gnu.org/bugs/?43709
- [oss-security] 20141125 CVE request: cpio heap-based buffer overflow [was Re: so, can we do something about lesspipe? (+ a cpio bug to back up the argument)] mailing-list
- [oss-security] 20141126 CVE request: cpio heap-based buffer overflow [was Re: so, can we do something about lesspipe? (+ a cpio bug to back up the argument)] mailing-list
- USN-2456-1 vendor-advisory
- [oss-security] 20141123 so, can we do something about lesspipe? (+ a cpio bug to back up the argument) mailing-list
- DSA-3111 vendor-advisory