Cpio
Monthly
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.
Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links pointing to files outside the intended extraction directory, defeating the security boundary that `--no-absolute-filenames` is designed to enforce. All GNU cpio versions tracked under CPE cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* are affected when processing tar archives in copy-in mode; the upstream fix exists only as a source commit with no tagged release confirmed at time of analysis. No active exploitation has been identified (no CISA KEV listing, no public exploit code), and exploitation requires a user to actively extract an attacker-supplied archive, materially constraining opportunistic risk.
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 19.4% and no vendor patch available.
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. Rated low severity (CVSS 1.9). Public exploit code available and no vendor patch available.
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Terminal escape sequence injection and output spoofing in GNU cpio's archive-listing mode (`cpio -it`) allows an attacker who supplies a crafted archive to manipulate terminal display or forge listing entries on the victim's screen. All versions of GNU cpio are affected per CPE data (cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*), reported by CERT-PL. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, exploitation requires only basic knowledge of cpio archive format and ANSI escape sequences once a victim can be induced to inspect a crafted archive.
Stack overflow in GNU cpio's make_path function (src/makepath.c) causes a denial of service when a victim extracts a crafted archive. The function uses alloca() to allocate stack memory sized by an attacker-controlled pathname embedded in the archive, allowing unbounded stack growth and a process crash with no confidentiality or integrity impact. No active exploitation or public proof-of-concept has been identified at time of analysis; the upstream fix is available as a single commit.
Hard-link path traversal in GNU cpio's tar extraction mode enables an attacker-controlled archive to create hard links pointing to files outside the intended extraction directory, defeating the security boundary that `--no-absolute-filenames` is designed to enforce. All GNU cpio versions tracked under CPE cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:* are affected when processing tar archives in copy-in mode; the upstream fix exists only as a source commit with no tagged release confirmed at time of analysis. No active exploitation has been identified (no CISA KEV listing, no public exploit code), and exploitation requires a user to actively extract an attacker-supplied archive, materially constraining opportunistic risk.
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 19.4% and no vendor patch available.
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. Rated low severity (CVSS 1.9). Public exploit code available and no vendor patch available.
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.