Package "cpio"
| Name: |
cpio
|
Description: |
GNU cpio -- a program to manage archives of files
|
| Latest version: |
2.15+dfsg-2.1ubuntu0.1 |
| Release: |
resolute (26.04) |
| Level: |
updates |
| Repository: |
main |
| Homepage: |
https://www.gnu.org/software/cpio/ |
Links
Download "cpio"
Other versions of "cpio" in Resolute
Changelog
|
cpio (2.15+dfsg-2.1ubuntu0.1) resolute-security; urgency=medium
* SECURITY UPDATE: Unbounded stack allocation
- debian/patches/CVE-2026-66485.patch: Minor fixes in src/makepath.c,
src/userspec.c.
- CVE-2026-66485
* SECURITY UPDATE: Hard link to file outside intended directory
- debian/patches/CVE-2026-66484.patch: The --no-absolute-filenames option
affects hard link targets too. in src/tar.c.
- CVE-2026-66484
* SECURITY UPDATE: Unescaped output
- debian/patches/CVE-2026-66486.patch: Quote file names in error messages
and in listings. in src/copyin.c, src/copyout.c, src/copypass.c,
src/main.c, tests/CVE-2019-14866.at.
- CVE-2026-66486
-- Isabel Garcia Contreras Mon, 17 Aug 2026 16:31:23 -0400
|
| CVE-2026-66485 |
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack m |
| CVE-2026-66484 |
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the |
| CVE-2026-66486 |
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio |
| CVE-2019-14866 |
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives fro |
|
About
-
Send Feedback to @ubuntu_updates
