Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Mageia 2019-0326 Critical Update: Cpio Local Attack Vulnerability Fix

mageia
Calendar Grey November 14, 2019
Dist Mageia Esm H88
MGASA-2023-0456 advisory information regarding cpio patch addressing vulnerabilities and mitigating local account intrusions.
in cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive (CVE-2015-1197)

Summary

in cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive (CVE-2015-1197).
Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to privilege escalation (CVE-2019-14866).
cpio has been updated to 2.13 that fixes theese issues.

References

- https://bugs.mageia.org/show_bug.cgi?id=25680

- https://ubuntu.com/security/notices/USN-4176-1

- https://www.cve.org/CVERecord?id=CVE-2015-1197

- https://www.cve.org/CVERecord?id=CVE-2019-14866

Topics%20covered

Topics Covered

security advisory local attack cpio arbitrary file write mageia

Resolution

SRPMS

- 7/core/cpio-2.13-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 14 Nov 2019
URL: https://advisories.mageia.org/MGASA-2019-0326.html
Type: security
CVE: CVE-2015-1197, CVE-2019-14866

Topics%20covered

Topics Covered

security advisory local attack cpio arbitrary file write mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here