https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:09:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-01329 bdu:2020-01329 https://cve.radiocsirt.org/vuln/bdu:2020-01329 https://cve.radiocsirt.org/vuln/bell-cve-2019-14866 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2019-14866 https://cve.radiocsirt.org/vuln/certfr-2021-avi-589 certfr-2021-avi-589 https://cve.radiocsirt.org/vuln/certfr-2021-avi-589 https://cve.radiocsirt.org/vuln/cleanstart-2024-vm66641 <p><strong>Affected:</strong> CleanStart: cpio</p> <p>Security vulnerability affects the cpio package. In all versions of cpio before 2.</p> <p><strong>Affected:</strong> CleanStart: cpio</p> <p>Security vulnerability affects the cpio package. In all versions of cpio before 2.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-vm66641 https://cve.radiocsirt.org/vuln/cnvd-2019-40709 cnvd-2019-40709 https://cve.radiocsirt.org/vuln/cnvd-2019-40709 https://cve.radiocsirt.org/vuln/euvd-2026-215913 EUVD-2026-215913 https://cve.radiocsirt.org/vuln/euvd-2026-215913 https://cve.radiocsirt.org/vuln/fkie_cve-2019-14866 <p>In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.</p> <p>In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-14866 https://cve.radiocsirt.org/vuln/ghsa-g3pr-277r-xcx7 <p>In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.</p> <p>In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.</p> https://cve.radiocsirt.org/vuln/ghsa-g3pr-277r-xcx7 https://cve.radiocsirt.org/vuln/gsd-2019-14866 gsd-2019-14866 https://cve.radiocsirt.org/vuln/gsd-2019-14866 https://cve.radiocsirt.org/vuln/opensuse-su-2019:2593-1 <p>Security update for cpio</p> <p>Security update for cpio</p> https://cve.radiocsirt.org/vuln/opensuse-su-2019:2593-1 https://cve.radiocsirt.org/vuln/rhsa-2021:0949 <p>expat: large number of colons in input makes parser consume high amount of resources, leading to DoS e2fsprogs: Crafted ext4 partition leads to out-of-bounds write e2fsprogs: Out-of-bounds write in e2fsck/rehash.c curl: heap buffer overflow in function tftp_receive_packet() nss: Out-of-bounds read when importing curve25519 private key nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 nss: Use-after-free in sftk_FreeSession due to improper refcounting glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass ibus: missing authorization allows local attacker to access the input bus of another user cpio: improper input validation when writing tar header fields leads to unexpected tar generation expat: heap-based buffer over-read via crafted XML input python: XSS vulnerability in the documentation XML-RPC server in server_title field nss: Check length of inputs for cryptographic primitives nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c systemd: memory leak in button_open() in login/logind-button.c when udev events are received libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c python: infinite loop in the tarfi…</p> <p>expat: large number of colons in input makes parser consume high amount of resources, leading to DoS e2fsprogs: Crafted ext4 partition leads to out-of-bounds write e2fsprogs: Out-of-bounds write in e2fsck/rehash.c curl: heap buffer overflow in function tftp_receive_packet() nss: Out-of-bounds read when importing curve25519 private key nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 nss: Use-after-free in sftk_FreeSession due to improper refcounting glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass ibus: missing authorization allows local attacker to access the input bus of another user cpio: improper input validation when writing tar header fields leads to unexpected tar generation expat: heap-based buffer over-read via crafted XML input python: XSS vulnerability in the documentation XML-RPC server in server_title field nss: Check length of inputs for cryptographic primitives nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c systemd: memory leak in button_open() in login/logind-button.c when udev events are received libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c python: infinite loop in the tarfi…</p> https://cve.radiocsirt.org/vuln/rhsa-2021:0949 https://cve.radiocsirt.org/vuln/ssa-202008 <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> https://cve.radiocsirt.org/vuln/ssa-202008 https://cve.radiocsirt.org/vuln/suse-su-2019:3059-1 <p>Security update for cpio</p> <p>Security update for cpio</p> https://cve.radiocsirt.org/vuln/suse-su-2019:3059-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-14866 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cpio, Ubuntu:16.04:LTS: cpio, Ubuntu:18.04:LTS: cpio</p> <p>In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cpio, Ubuntu:16.04:LTS: cpio, Ubuntu:18.04:LTS: cpio</p> <p>In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-14866 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1353 <p>Ein lokaler Angreifer kann eine Schwachstelle in GNU Cpio ausnutzen, um Informationen offenzulegen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in GNU Cpio ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1353