{"id":"CVE-2021-38185","aliases":["ALPINE-CVE-2021-38185","ALSA-2022:1991","AZL-6357","BELL-CVE-2021-38185","DEBIAN-CVE-2021-38185","DLA-3445-1","EUVD-2021-24655","GHSA-pp74-ghrg-jwfh","MGASA-2021-0423","OESA-2021-1325","RHSA-2022:1991","RLSA-2022:1991","SUSE-RU-2021:2779-1","SUSE-RU-2021:2780-1","SUSE-SU-2021:14777-1","SUSE-SU-2021:14788-1","SUSE-SU-2021:2686-1","SUSE-SU-2021:2689-1","SUSE-SU-2021:2808-1","UBUNTU-CVE-2021-38185","USN-5064-1","USN-5064-2","USN-5064-3","openSUSE-SU-2024:10697-1"],"status":"published","title":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file,...","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.04165,"percentile":0.91025,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-190"],"published":"2021-08-07T00:00:00Z","modified":"2026-11-06T02:31:06Z","exploits":[{"source":"pocgithub","id":"fangqyi/cpiopwn","title":"fangqyi/cpiopwn","date":"2021-07-19","url":"https://github.com/fangqyi/cpiopwn"}],"fixes":[{"ecosystem":"Alpine:v3.14","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cpio","fixed_in":["2.13-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cpio","fixed_in":["2.12-11.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cpio","fixed_in":["2.13-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cpio","fixed_in":["2.13+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cpio","fixed_in":["2.13+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cpio","fixed_in":["2.13+dfsg-5"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"cpio","fixed_in":["2.13-5.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"cpio","fixed_in":["2.13-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"cpio","fixed_in":["2.13-4.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio","fixed_in":["0:2.12-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debuginfo","fixed_in":["0:2.12-11.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debugsource","fixed_in":["0:2.12-11.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cpio","fixed_in":["0:2.12-11.el8"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cpio","fixed_in":["2.11-36.12.1","2.11-36.9.1","2.11-36.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"cpio","fixed_in":["2.12-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"cpio","fixed_in":["2.9-75.81.8.1","2.9-75.81.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"cpio","fixed_in":["2.9-75.81.8.1","2.9-75.81.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-1ubuntu1.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","fixed_in":["2.11+dfsg-5ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cpio","fixed_in":["2.12+dfsg-6ubuntu0.18.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"cpio","fixed_in":["2.13+dfsg-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cpio","fixed_in":["2.13+dfsg-4ubuntu4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-11.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-9+deb10u1"}]}],"versions":["2.12+dfsg-9"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-5.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-4.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-11.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cpio-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-11.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12-11.el8"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-75.81.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-75.81.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-75.81.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9-75.81.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11-36.15.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm2"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2","2.11+dfsg-1ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1+esm1"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1","2.11+dfsg-5ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.4"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6","2.12+dfsg-6ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-2ubuntu0.3"}]}],"versions":["2.12+dfsg-9","2.12+dfsg-9ubuntu1","2.13+dfsg-1","2.13+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-4ubuntu4"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12+dfsg-6ubuntu0.18.04.4"}]}],"versions":["2.11+dfsg-6","2.12+dfsg-6","2.12+dfsg-6ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13+dfsg-2ubuntu0.3"}]}],"versions":["2.12+dfsg-9","2.12+dfsg-9ubuntu1","2.13+dfsg-1","2.13+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-5ubuntu1.1+esm1"}]}],"versions":["2.11+dfsg-4.1ubuntu1","2.11+dfsg-5ubuntu1","2.11+dfsg-5ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11+dfsg-1ubuntu1.2+esm2"}]}],"versions":["2.11+dfsg-1ubuntu1","2.11+dfsg-1ubuntu1.1","2.11+dfsg-1ubuntu1.2","2.11+dfsg-1ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cpio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-3.3"}]}],"bundled":3}],"products":[{"vendor":"gnu","product":"cpio"}],"references":[{"url":"https://github.com/fangqyi/cpiopwn","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00000.html","tags":["x_transferred","Exploit","Mailing List","Vendor Advisory","evidence","report"]},{"url":"https://lists.gnu.org/archive/html/bug-cpio/2021-08/msg00002.html","tags":["x_transferred","Exploit","Mailing List","Vendor Advisory","evidence","report"]},{"url":"https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=dd96882877721703e19272fe25034560b794061b","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38185","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pp74-ghrg-jwfh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-38185","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1991.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-38185","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-38185","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38185","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0423.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29366","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-August/009282.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XORUFH2I27QQWZXGSRUKWLXW5NX5KLXA/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5064-1","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1325","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1991","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991731","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1991.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38185","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1991","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2021-2779/suse-ru-20212779-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189465","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38185","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/-2021-2780/suse-ru-20212780-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189206","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114788-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212686-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212689-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212808-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38185","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5064-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5064-3","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14866","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-38185","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-07T00:00:00Z","modified":"2025-06-09T15:11:29.808Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:33:07.349244Z"}],"euvd":[{"id":"EUVD-2021-24655","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-07T00:00:00Z","modified":"2025-06-09T15:11:29Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:27.753525Z"}],"ghsa":[{"id":"GHSA-pp74-ghrg-jwfh","title":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file,...","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2022-05-24T19:10:24Z","modified":"2023-06-05T00:30:18Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:54:37.773458Z"}],"nvd":[{"id":"CVE-2021-38185","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-08T00:15:07.027Z","modified":"2026-06-17T04:01:42.95Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:06:56.562207Z"}],"osv":[{"id":"ALPINE-CVE-2021-38185","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-08T00:15:07.027Z","modified":"2026-11-03T06:31:44.000430021Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"AZL-6357","title":"CVE-2021-38185 affecting package cpio for versions less than 2.13-4","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-08T00:15:07Z","modified":"2026-04-21T04:32:10.086546Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2021-38185","title":"CVE-2021-38185 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:43.184826Z","modified":"2026-01-26T09:48:59.055319Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-38185","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-08T00:15:07.027Z","modified":"2026-11-11T02:45:22.981665088Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T11:24:16.480676Z"},{"id":"DEBIAN-CVE-2021-38185","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-08T00:15:07.027Z","modified":"2026-10-23T18:03:31.422207932Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2021-1325","title":"cpio security update","description":"GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.\r\n\r\nSecurity Fix(es):\r\n\r\nGNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.(CVE-2021-38185)","status":"published","published":"2021-08-28T11:04:33Z","modified":"2026-08-18T01:15:57.380751644Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2022:1991","title":"Red Hat Security Advisory: cpio security update","status":"published","published":"2024-09-16T06:30:41Z","modified":"2026-02-24T10:05:20Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1991","title":"Moderate: cpio security update","description":"The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another.\n\nSecurity Fix(es):\n\n* cpio: integer overflow in ds_fgetstr() in dstring.c can lead to an out-of-bounds write via a crafted pattern file (CVE-2021-38185)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:43:49Z","modified":"2026-02-04T22:00:09.611099Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-38185","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.","status":"published","published":"2021-08-08T00:15:00Z","modified":"2026-02-04T04:31:08.54688Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"ALSA-2022:1991","title":"Moderate: cpio security update","description":"The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another.\n\nSecurity Fix(es):\n\n* cpio: integer overflow in ds_fgetstr() in dstring.c can lead to an out-of-bounds write via a crafted pattern file (CVE-2021-38185)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:43:49Z","modified":"2026-10-29T11:01:18.719454897Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-3445-1","title":"cpio - security update","status":"published","published":"2023-06-04T00:00:00Z","modified":"2026-03-09T01:23:01.987372Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2021-0423","title":"Updated cpio packages fix security vulnerability","description":"GNU cpio through 2.13 allows attackers to execute arbitrary code via a\ncrafted pattern file, because of a dstring.c ds_fgetstr integer overflow\nthat triggers an out-of-bounds heap write. (CVE-2021-38185).\n","status":"published","published":"2021-09-23T04:49:29Z","modified":"2026-04-16T04:43:12.975355218Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:10697-1","title":"cpio-2.13-3.3 on GA media","description":"These are all security issues fixed in the cpio-2.13-3.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:34:12.536678Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-RU-2021:2779-1","title":"Recommended update for cpio","description":"This update for cpio fixes the following issues:\n\n- A regression in the previous update could lead to crashes (bsc#1189465)\n  ","status":"published","published":"2021-08-19T14:08:43Z","modified":"2026-02-04T04:26:07.263743Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2021:2780-1","title":"Recommended update for cpio","description":"This update for cpio fixes the following issues:\n\n- A regression in the previous update could lead to crashes (bsc#1189465)\n","status":"published","published":"2021-08-19T14:10:03Z","modified":"2026-02-04T03:31:19.896904Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2021:14777-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n  It was possible to trigger Remote code execution due to a integer overflow (CVE-2021-38185, bsc#1189206)\n  ","status":"published","published":"2021-08-12T02:00:52Z","modified":"2026-02-04T02:27:42.800249Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:14788-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- A patch previously applied to remedy CVE-2021-38185 introduced a regression\n  that had the potential to cause a segmentation fault in cpio. [bsc#1189465]\n","status":"published","published":"2021-08-23T08:53:02Z","modified":"2026-02-04T03:55:58.866668Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2686-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n  It was possible to trigger Remote code execution due to a integer overflow (CVE-2021-38185, bsc#1189206)\n  ","status":"published","published":"2021-08-14T01:58:44Z","modified":"2026-02-04T03:01:19.099236Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2689-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\nIt was possible to trigger Remote code execution due to a integer overflow (CVE-2021-38185, bsc#1189206)\n\n","status":"published","published":"2021-08-16T08:54:52Z","modified":"2026-02-04T03:23:48.079141Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2808-1","title":"Security update for cpio","description":"This update for cpio fixes the following issues:\n\n- A patch previously applied to remedy CVE-2021-38185 introduced a regression\n  that had the potential to cause a segmentation fault in cpio. [bsc#1189465]\n","status":"published","published":"2021-08-23T10:09:18Z","modified":"2026-02-04T03:44:12.166218Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5064-1","title":"cpio vulnerability","description":"Maverick Chung and Qiaoyi Fang discovered that cpio incorrectly handled\ncertain pattern files. A remote attacker could use this issue to cause cpio\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2021-09-08T11:14:41Z","modified":"2026-02-10T04:42:18Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5064-2","title":"cpio vulnerability","description":"USN-5064-1 fixed vulnerabilities in GNU cpio. This update provides\nthe corresponding updates for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n Maverick Chung and Qiaoyi Fang discovered that cpio incorrectly handled\n certain pattern files. A remote attacker could use this issue to cause cpio\n to crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","status":"published","published":"2022-01-27T17:25:42Z","modified":"2026-06-25T13:30:44.679794074Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5064-3","title":"cpio vulnerability","description":"USN-5064-1 fixed a vulnerability in GNU. This update provides\nthe corresponding update for Ubuntu 14.04 LTS.\n\nOriginal advisory details:\n\n Maverick Chung and Qiaoyi Fang discovered that cpio incorrectly handled\n certain pattern files. A remote attacker could use this issue to cause cpio\n to crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","status":"published","published":"2023-08-03T13:30:12Z","modified":"2026-06-29T13:49:31.121376504Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}