UbuntuUpdates.org

Package "cpio"

Name: cpio

Description:

GNU cpio -- a program to manage archives of files
Latest version: 2.13+dfsg-7ubuntu0.1
Release: jammy (22.04)
Level: security
Repository: main
Homepage: https://www.gnu.org/software/cpio/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "cpio"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "cpio" in Jammy

Repository Area Version
base main 2.13+dfsg-7
base universe 2.13+dfsg-7
security universe 2.13+dfsg-7ubuntu0.1
updates main 2.13+dfsg-7ubuntu0.1
updates universe 2.13+dfsg-7ubuntu0.1

Changelog

Version: 2.13+dfsg-7ubuntu0.1 2024-04-29 12:07:00 UTC

  cpio (2.13+dfsg-7ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Path traversal vulnerability
    - debian/patches/CVE-2023-7207.patch: Create symlink placeholder
      if --no-absolute-filenames was given and replace placeholders
      after extraction.
    - debian/patches/revert-CVE-2015-1197-handling.patch: Removed.
    - CVE-2023-7207

 -- Fabian Toepfer <email address hidden> Sun, 28 Apr 2024 14:30:36 +0200
CVE-2023-7207 Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in
CVE-2015-1197 cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive


About   -   Send Feedback to @ubuntu_updates