https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:00:48 +0000 https://cve.radiocsirt.org/vuln/alsa-2022:1991 <p><strong>Affected:</strong> AlmaLinux:8: cpio</p> <p>The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another.</p> <p>Security Fix(es):</p> <p>* cpio: integer overflow in ds_fgetstr() in dstring.c can lead to an out-of-bounds write via a crafted pattern file (CVE-2021-38185)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: cpio</p> <p>The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another.</p> <p>Security Fix(es):</p> <p>* cpio: integer overflow in ds_fgetstr() in dstring.c can lead to an out-of-bounds write via a crafted pattern file (CVE-2021-38185)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2022:1991 https://cve.radiocsirt.org/vuln/bdu:2021-05090 bdu:2021-05090 https://cve.radiocsirt.org/vuln/bdu:2021-05090 https://cve.radiocsirt.org/vuln/bell-cve-2021-38185 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2021-38185 https://cve.radiocsirt.org/vuln/certfr-2022-avi-952 certfr-2022-avi-952 https://cve.radiocsirt.org/vuln/certfr-2022-avi-952 https://cve.radiocsirt.org/vuln/cleanstart-2024-hf57565 <p><strong>Affected:</strong> CleanStart: cpio</p> <p>Security vulnerability affects the cpio package. GNU cpio through 2.</p> <p><strong>Affected:</strong> CleanStart: cpio</p> <p>Security vulnerability affects the cpio package. GNU cpio through 2.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-hf57565 https://cve.radiocsirt.org/vuln/euvd-2026-243458 EUVD-2026-243458 https://cve.radiocsirt.org/vuln/euvd-2026-243458 https://cve.radiocsirt.org/vuln/fkie_cve-2021-38185 <p>GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.</p> <p>GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-38185 https://cve.radiocsirt.org/vuln/ghsa-pp74-ghrg-jwfh <p>GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.</p> <p>GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.</p> https://cve.radiocsirt.org/vuln/ghsa-pp74-ghrg-jwfh https://cve.radiocsirt.org/vuln/gsd-2021-38185 gsd-2021-38185 https://cve.radiocsirt.org/vuln/gsd-2021-38185 https://cve.radiocsirt.org/vuln/msrc_cve-2021-38185 msrc_CVE-2021-38185 https://cve.radiocsirt.org/vuln/msrc_cve-2021-38185 https://cve.radiocsirt.org/vuln/oesa-2021-1325 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: cpio, openEuler:20.03-LTS-SP2: cpio</p> <p>GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fix(es): GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.(CVE-2021-38185)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: cpio, openEuler:20.03-LTS-SP2: cpio</p> <p>GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fix(es): GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.(CVE-2021-38185)</p> https://cve.radiocsirt.org/vuln/oesa-2021-1325 https://cve.radiocsirt.org/vuln/opensuse-su-2024:10697-1 <p>cpio-2.13-3.3 on GA media</p> <p>cpio-2.13-3.3 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:10697-1 https://cve.radiocsirt.org/vuln/ssa-202008 <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> https://cve.radiocsirt.org/vuln/ssa-202008 https://cve.radiocsirt.org/vuln/suse-ru-2021:2779-1 <p>Recommended update for cpio</p> <p>Recommended update for cpio</p> https://cve.radiocsirt.org/vuln/suse-ru-2021:2779-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-38185 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cpio, Ubuntu:Pro:16.04:LTS: cpio, Ubuntu:18.04:LTS: cpio, Ubuntu:20.04:LTS: cpio, Ubuntu:22.04:LTS: cpio</p> <p>GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cpio, Ubuntu:Pro:16.04:LTS: cpio, Ubuntu:18.04:LTS: cpio, Ubuntu:20.04:LTS: cpio, Ubuntu:22.04:LTS: cpio</p> <p>GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-38185 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1852 <p>Ein lokaler Angreifer kann eine Schwachstelle in cpio ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in cpio ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1852