CVE-2015-1197

Name
CVE-2015-1197
Description
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
BID http://www.securityfocus.com/bid/71914
Exploit http://www.openwall.com/lists/oss-security/2015/01/07/5
Exploit https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html
Exploit https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669
MLIST http://www.openwall.com/lists/oss-security/2015/01/18/7
CONFIRM http://advisories.mageia.org/MGASA-2015-0080.html
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2015:066
UBUNTU http://www.ubuntu.com/usn/USN-2906-1
cve@mitre.org http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
cve@mitre.org http://www.openwall.com/lists/oss-security/2023/12/21/8
cve@mitre.org http://www.openwall.com/lists/oss-security/2023/12/27/1

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnu:cpio:2.11:*:*:*:*:*:*:* cpio == None == 2.11

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
cpio edge-community 2.13-r0 None fixed
cpio 3.22-community 2.13-r0 None fixed
cpio 3.21-community 2.13-r0 None fixed
cpio 3.20-community 2.13-r0 None fixed
cpio 3.19-community 2.13-r0 None fixed
cpio 3.18-community 2.13-r0 None fixed
cpio 3.17-community 2.13-r0 None fixed