CVE-1999-1572
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask...
CVE-1999-1572 is a low vulnerability (CVSS 2.1) in Debian Linux, published July 16, 1996. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in cpio 2.5-1.2.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.55%EPSS, 46th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.5-1.2cpio +19 more
Description
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cpioDebian:12 | before 2.5-1.2 | 2.5-1.2 |
cpioDebian:13 | before 2.5-1.2 | 2.5-1.2 |
cpioDebian:14 | before 2.5-1.2 | 2.5-1.2 |
cpioDebian:3.0 | before 2.4.2-39woody1, plus listed versions 2.4.2-39 | 2.4.2-39woody1 |
cpioRed Hat:enterprise_linux:4::as | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::as | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpioRed Hat:enterprise_linux:4::desktop | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::desktop | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpioRed Hat:enterprise_linux:4::es | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::es | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cpioRed Hat:enterprise_linux:4::ws | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpio-debuginfoRed Hat:enterprise_linux:4::ws | before 0:2.5-7.EL4.1 | 0:2.5-7.EL4.1 |
cpioRed Hat:enterprise_linux:3::as | before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::as | before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpioRed Hat:enterprise_linux:3::desktop | before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::desktop | before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpioRed Hat:enterprise_linux:3::es | before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::es | before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpioRed Hat:enterprise_linux:3::ws | before 0:2.5-3e.3 | 0:2.5-3e.3 |
cpio-debuginfoRed Hat:enterprise_linux:3::ws | before 0:2.5-3e.3 | 0:2.5-3e.3 |
What each source reports
NVD Score used
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
CVE-1999-1572- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
CVE-1999-1572- Updated
- 2026-11-02
EUVDEUVD-1999-1553No score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
EUVD-1999-1553- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j8q5-qf4r-w33wNo score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask...
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
GHSA-j8q5-qf4r-w33w- Updated
- 2026-11-02
OSVNo score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
CVE-1999-1572- Updated
- 2026-11-02
OSVDEBIAN-CVE-1999-1572No score
cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- Record
DEBIAN-CVE-1999-1572- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
marc.info?l=bugtraq&m=110763404701519&w=2
redhat.com/support/errata/RHSA-2005-073.html
exchange.xforce.ibmcloud.com/vulnerabilities/19167
secunia.com/advisories/17063
trustix.org/errata/2005/0003
Show 23 moreShow less
support.avaya.com/elmodocs2/security/ASA-2005-212.pdf
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10888
freebsd.org/cgi/query-pr.cgi?pr=bin/1391
mandriva.com/security/advisories?name=MDKSA-2005:032
debian.org/security/2005/dsa-664
nvd.nist.gov/vuln/detail/CVE-1999-1572
github.com/advisories/GHSA-j8q5-qf4r-w33w
security-tracker.debian.org/tracker/CVE-1999-1572
access.redhat.com/errata/RHSA-2005:073
bugzilla.redhat.com/show_bug.cgi?id=145725
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_073.json
cve.org/CVERecord?id=CVE-1999-1572