A vulnerability has been discovered in cpio, which can lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/cpio | * | < 2.13-r1 | >= 2.13-r1 |
cpio is a file archival tool which can also read and write tar files.
Multiple vulnerabilities have been discovered in cpio. Please review the CVE identifiers referenced below for details.
GNU cpio allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
There is no known workaround at this time.
All cpio users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/cpio-2.13-r1"
Two vulnerabilities have been found in GNU cpio, the worst of which could result in execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/cpio | * | < 2.11-r3 | >= 2.11-r3 |
GNU cpio copies files into or out of a cpio or tar archive.
Two vulnerabilities have been discovered in GNU cpio:
A remote attacker may be able to entice a user to open a specially crafted archive using GNU cpio, possibly resulting in execution of arbitrary code, a Denial of Service condition, or overwriting arbitrary files.
There is no known workaround at this time.
All GNU cpio users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/cpio-2.11-r3"
A heap-based buffer overflow in cpio might allow a remote rmt server to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/cpio | * | < 2.11 | >= 2.11 |
GNU cpio copies files into or out of a cpio or tar archive.
Cpio contains a heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c.
A remote server could sending more data than was requested, related to archive filenames that contain a : (colon) character, possibly resulting in execution of arbitrary code or a Denial of Service condition.
There is no known workaround at this time.
All cpio users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/cpio-2.11"
GNU cpio contains a buffer overflow vulnerability, possibly resulting in a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/cpio | * | < 2.9-r1 | >= 2.9-r1 |
GNU cpio copies files into or out of a cpio or tar archive.
A buffer overflow vulnerability in the safer_name_suffix() function in GNU cpio has been discovered.
A remote attacker could entice a user to open a specially crafted archive file resulting in a stack-based buffer overflow, possibly crashing the application. It is disputed whether the execution of arbitrary code is possible.
There is no known workaround at this time.
All GNU cpio users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/cpio-2.9-r1"
cpio contains a flaw which may allow a specially crafted cpio archive to extract files to an arbitrary directory.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/cpio | * | < 2.6-r3 | >= 2.6-r3 |
cpio is a file archival tool which can also read and write tar files.
A vulnerability has been found in cpio that can potentially allow a cpio archive to extract its files to an arbitrary directory of the creator's choice.
An attacker could create a malicious cpio archive which would create files in arbitrary locations on the victim's system. This issue could also be used in conjunction with a previous race condition vulnerability (CAN-2005-1111) to change permissions on files owned by the victim.
There is no known workaround at this time.
All cpio users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/cpio-2.6-r3"