https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:10:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349561 EUVD-2026-349561 https://cve.radiocsirt.org/vuln/euvd-2026-349561 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66486 <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.</p> <p>This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30</p> <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.</p> <p>This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-66486 https://cve.radiocsirt.org/vuln/ghsa-p5w5-qcg3-g8gx <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.</p> <p>This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30</p> <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.</p> <p>This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30</p> https://cve.radiocsirt.org/vuln/ghsa-p5w5-qcg3-g8gx https://cve.radiocsirt.org/vuln/msrc_cve-2026-66486 msrc_CVE-2026-66486 https://cve.radiocsirt.org/vuln/msrc_cve-2026-66486 https://cve.radiocsirt.org/vuln/oesa-2026-3540 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: cpio, openEuler:24.03-LTS-SP3: cpio, openEuler:24.03-LTS-SP4: cpio, openEuler:20.03-LTS-SP4: cpio, openEuler:22.03-LTS-SP4: cpio</p> <p>GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fix(es):</p> <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.</p> <p>This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: cpio, openEuler:24.03-LTS-SP3: cpio, openEuler:24.03-LTS-SP4: cpio, openEuler:20.03-LTS-SP4: cpio, openEuler:22.03-LTS-SP4: cpio</p> <p>GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe. Security Fix(es):</p> <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed.</p> <p>This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30(CVE-2026-66486)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3540 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11618-1 <p>cpio-2.15-8.1 on GA media</p> <p>cpio-2.15-8.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11618-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23355-1 <p>Security update for cpio</p> <p>Security update for cpio</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23355-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-66486 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cpio, Ubuntu:Pro:16.04:LTS: cpio, Ubuntu:Pro:18.04:LTS: cpio, Ubuntu:Pro:20.04:LTS: cpio, Ubuntu:22.04:LTS: cpio, Ubuntu:24.04:LTS: cpio, Ubuntu:26.04:LTS: cpio</p> <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: cpio, Ubuntu:Pro:16.04:LTS: cpio, Ubuntu:Pro:18.04:LTS: cpio, Ubuntu:Pro:20.04:LTS: cpio, Ubuntu:22.04:LTS: cpio, Ubuntu:24.04:LTS: cpio, Ubuntu:26.04:LTS: cpio</p> <p>GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-66486 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2722 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cpio ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen oder Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cpio ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2722