rpm package
opensuse/cpio&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/cpio&distro=openSUSE%20Leap%2016.0
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-66486 | Med | — | < 2.15-160000.3.1 | 2.15-160000.3.1 | Aug 10, 2026 | GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing membe | |
| CVE-2026-66485 | Med | — | < 2.15-160000.3.1 | 2.15-160000.3.1 | Aug 10, 2026 | GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio arch | |
| CVE-2026-66484 | Med | — | < 2.15-160000.3.1 | 2.15-160000.3.1 | Aug 10, 2026 | GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name fu |
- affected < 2.15-160000.3.1fixed 2.15-160000.3.1
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing membe
- affected < 2.15-160000.3.1fixed 2.15-160000.3.1
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio arch
- affected < 2.15-160000.3.1fixed 2.15-160000.3.1
GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name fu