CVE-2014-1197
Updated cpio package fixes security vulnerability
In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1197).
What each source reports
OSVMGASA-2015-0080 No score
Updated cpio package fixes security vulnerability
In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1197).
- Record
MGASA-2015-0080- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cpioMageia:4 |
before 2.11-6.3.mga4 | 2.11-6.3.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1197 is a vulnerability with no CVSS score yet in cpio, published February 19, 2015. No source lists public exploit code. Fixed in cpio 2.11-6.3.mga4.