CVE-1999-1572
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask...
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
Exploit likelihood
What each source reports
NVD Score used
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
CVE-1999-1572- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
CVE-1999-1572- Updated
- 2026-11-02
EUVDEUVD-1999-1553 No score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
EUVD-1999-1553- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j8q5-qf4r-w33w No score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask...
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
GHSA-j8q5-qf4r-w33w- Updated
- 2026-11-02
OSV No score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
CVE-1999-1572- Updated
- 2026-11-02
OSVDEBIAN-CVE-1999-1572 No score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
DEBIAN-CVE-1999-1572- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cpioDebian:12 |
before 2.5-1.2 | 2.5-1.2 |
cpioDebian:13 |
before 2.5-1.2 | 2.5-1.2 |
cpioDebian:14 |
before 2.5-1.2 | 2.5-1.2 |
cpioDebian:3.0 |
before 2.4.2-39woody1, plus listed versions 2.4.2-39 |
2.4.2-39woody1 |
cpioRed Hat:enterprise_linux:4::as |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpioRed Hat:enterprise_linux:4::desktop |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpioRed Hat:enterprise_linux:4::es |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cpioRed Hat:enterprise_linux:4::ws |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpioRed Hat:enterprise_linux:3::as |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpioRed Hat:enterprise_linux:3::desktop |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpioRed Hat:enterprise_linux:3::es |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpioRed Hat:enterprise_linux:3::ws |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.5-3e.3 | 0:2.5-3e.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-1999-1572 is a low vulnerability (CVSS 2.1) in Debian Linux, published July 16, 1996. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in cpio 2.5-1.2.
References
marc.info?l=bugtraq&m=110763404701519&w=2
redhat.com/support/errata/RHSA-2005-073.html
exchange.xforce.ibmcloud.com/vulnerabilities/19167
secunia.com/advisories/17063
trustix.org/errata/2005/0003
Show 23 moreShow less
support.avaya.com/elmodocs2/security/ASA-2005-212.pdf
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10888
freebsd.org/cgi/query-pr.cgi?pr=bin/1391
mandriva.com/security/advisories?name=MDKSA-2005:032
debian.org/security/2005/dsa-664
nvd.nist.gov/vuln/detail/CVE-1999-1572
github.com/advisories/GHSA-j8q5-qf4r-w33w
security-tracker.debian.org/tracker/CVE-1999-1572
access.redhat.com/errata/RHSA-2005:073
bugzilla.redhat.com/show_bug.cgi?id=145725
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_073.json
cve.org/CVERecord?id=CVE-1999-1572