CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-7207
https://notcve.org/view.php?id=CVE-2023-7207
Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in --no-absolute-filenames. Upstream has since provided a proper fix to --no-absolute-filenames. El cpio de Debian contiene una vulnerabilidad de path traversal. Este problema se introdujo al revertir los parches CVE-2015-1197 que habían provocado una regresión en --no-absolute-filenames. • http://www.openwall.com/lists/oss-security/2024/01/05/1 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059163 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7207 https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628 https://www.openwall.com/lists/oss-security/2023/12/21/8 •
CVSS: 6.5EPSS: 4%CPEs: 3EXPL: 0CVE-2016-2037
https://notcve.org/view.php?id=CVE-2016-2037
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. La función cpio_safer_name_suffix en util.c en cpio 2.11 permite a atacantes remotos causar una denegación de servicio (escritura fuera de rango) através de un archivo cpio manipulado. • http://www.debian.org/security/2016/dsa-3483 http://www.openwall.com/lists/oss-security/2016/01/19/4 http://www.openwall.com/lists/oss-security/2016/01/22/4 http://www.securityfocus.com/bid/82293 http://www.securitytracker.com/id/1035067 http://www.ubuntu.com/usn/USN-2906-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.1EPSS: 1%CPEs: 2EXPL: 6CVE-2014-9112 – cpio: heap-based buffer overflow flaw in list_file()
https://notcve.org/view.php?id=CVE-2014-9112
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive. Desbordamiento de buffer basado en memoria dinámica en la función process_copy_in en GNU Cpio 2.11 permite a atacantes remotos causar una denegación de servicio a través de un valor de bloque grande en un archivo cpio. A heap-based buffer overflow flaw was found in cpio's list_file() function. An attacker could provide a specially crafted archive that, when processed by cpio, would crash cpio, or potentially lead to arbitrary code execution. • http://seclists.org/fulldisclosure/2014/Nov/74 http://secunia.com/advisories/60167 http://secunia.com/advisories/62145 http://www.debian.org/security/2014/dsa-3111 http://www.openwall.com/lists/oss-security/2014/11/23/2 http://www.openwall.com/lists/oss-security/2014/11/25/2 http://www.openwall.com/lists/oss-security/2014/11/26/20 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.securityfocus.com/bid/71248 http://ww • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 4.7EPSS: 0%CPEs: 5EXPL: 0CVE-2005-1111
https://notcve.org/view.php?id=CVE-2005-1111
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:03.cpio.asc ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2/SCOSA-2006.2.txt ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.32/SCOSA-2005.32.txt http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html http://marc.info/?l=bugtraq&m=111342664116120&w=2 http://secunia.com/advisories/16998 http://secunia.com/advisories/17123 http://secunia.com/advisories/17532 http://secunia&# • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •