Every CVESearch/Get API key

CVE-2015-1197

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to...

1.9 LowPublic exploitFix available

CVE-2015-1197 is a low vulnerability (CVSS 1.9) in Gnu Cpio, published February 19, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.91%, the 87th percentile. Fixed in cpio 2.11+dfsg-4.1.

Severity
1.9 LowCVSS 2.0, NVD
Exploit chance
2.91%EPSS, 87th percentile
Exploitation
None known1 public exploit
Fixed in
2.11+dfsg-4.1cpio +12 more

Description

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Exploit likelihood

2.91%Up 1.8 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cpio
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
before 2.13-16.el9_2.tuxcare.els1
2.13-16.el9_2.tuxcare.els1
cpio
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
before 2.13-16.el9_6.tuxcare.els1
2.13-16.el9_6.tuxcare.els1
cpio
Debian:12
before 2.11+dfsg-4.1
2.11+dfsg-4.1
cpio
Debian:13
before 2.11+dfsg-4.1
2.11+dfsg-4.1
cpio
Debian:14
before 2.11+dfsg-4.1
2.11+dfsg-4.1
cpio
Mageia:7
From an advisory covering 2 CVEs
before 2.13-1.mga7
2.13-1.mga7
cpio
openEuler:20.03-LTS-SP1
before 2.13-5.oe1
2.13-5.oe1
cpio
openEuler:20.03-LTS-SP3
before 2.13-5.oe1
2.13-5.oe1
cpio
openEuler:22.03-LTS
before 2.13-8.oe2203
2.13-8.oe2203
cpio
openEuler:22.03-LTS-SP1
before 2.13-8.oe2203sp1
2.13-8.oe2203sp1
cpio
Ubuntu:14.04:LTS
before 2.11+dfsg-1ubuntu1.2, plus listed versions
2.11+dfsg-1ubuntu12.11+dfsg-1ubuntu1.1
2.11+dfsg-1ubuntu1.2
cpio
Ubuntu:14.04:LTS
From an advisory covering 2 CVEs
before 2.11+dfsg-1ubuntu1.2, plus listed versions
2.11+dfsg-1ubuntu12.11+dfsg-1ubuntu1.1
2.11+dfsg-1ubuntu1.2
cpio
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
before 2.13-3.3
2.13-3.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitTAR Path Traversal in Zimbra (CVE-2022-41352)2022-06-28

What each source reports

NVD Score used1.9

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Record
CVE-2015-1197
CVSS 2.0
1.9 LowAV:L/AC:M/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE ListNo score

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Record
CVE-2015-1197
Updated
2026-11-02
EUVDEUVD-2015-1338No score

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Record
EUVD-2015-1338
Updated
2026-11-02
GitHub AdvisoriesGHSA-447h-6vgc-mg6pNo score

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to...

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Record
GHSA-447h-6vgc-mg6p
Updated
2026-11-02
OSVBELL-CVE-2015-11971.9

CVE-2015-1197 does not affect BellSoft software

Record
BELL-CVE-2015-1197
CVSS 2.0
1.9 LowAV:L/AC:M/Au:N/C:N/I:P/A:N
Updated
2026-11-02
OSVCLSA-2026-1786620962No score

cpio: Fix of CVE-2023-7207

  • CVE-2023-7207: path traversal via absolute symlink targets under --no-absolute-filenames; drop cpio-2.13-revert-CVE-2015-1197-fix.patch and apply the upstream symlink-placeholder fix instead
Record
CLSA-2026-1786620962
Updated
2026-11-02
Show 11 moreShow less
OSVCLSA-2026-1786621771No score

cpio: Fix of CVE-2023-7207

  • CVE-2023-7207: path traversal via absolute symlink targets under --no-absolute-filenames; drop cpio-2.13-revert-CVE-2015-1197-fix.patch and apply the upstream symlink-placeholder fix instead
Record
CLSA-2026-1786621771
Updated
2026-11-02
OSVNo score

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Record
CVE-2015-1197
Updated
2026-11-02
OSVDEBIAN-CVE-2015-1197No score

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Record
DEBIAN-CVE-2015-1197
Updated
2026-11-02
OSVMGASA-2019-0326No score

Updated cpio packages fix security vulnerabilities

in cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive (CVE-2015-1197).

Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to privilege escalation (CVE-2019-14866).

cpio has been updated to 2.13 that fixes theese issues.

Record
MGASA-2019-0326
Updated
2026-11-02
OSVOESA-2023-1300No score

cpio security update

Security Fix(es):

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.(CVE-2015-1197)

Record
OESA-2023-1300
Updated
2026-11-02
OSVOESA-2023-1336No score

cpio security update

GNU cpio copies files into or out of a cpio or tar archive.The archive can be another file on the disk, a magnetic tape, or a pipe.

Security Fix(es):

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.(CVE-2015-1197)

Record
OESA-2023-1336
Updated
2026-11-02
OSVOESA-2023-1337No score

cpio security update

GNU cpio copies files into or out of a cpio or tar archive.The archive can be another file on the disk, a magnetic tape, or a pipe.

Security Fix(es):

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.(CVE-2015-1197)

Record
OESA-2023-1337
Updated
2026-11-02
OSVOESA-2023-1338No score

cpio security update

GNU cpio copies files into or out of a cpio or tar archive. The archive can be another file on the disk, a magnetic tape, or a pipe.

Security Fix(es):

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.(CVE-2015-1197)

Record
OESA-2023-1338
Updated
2026-11-02
OSVopenSUSE-SU-2024:10697-1No score

cpio-2.13-3.3 on GA media

These are all security issues fixed in the cpio-2.13-3.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10697-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-1197No score

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Record
UBUNTU-CVE-2015-1197
Updated
2026-11-02
OSVUSN-2906-1No score

cpio vulnerabilities

Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic links when used with the --no-absolute-filenames option. If a user or automated system were tricked into extracting a specially-crafted cpio archive, a remote attacker could possibly use this issue to write arbitrary files. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-1197)

Gustavo Grieco discovered that GNU cpio incorrectly handled memory when extracting archive files. If a user or automated system were tricked into extracting a specially-crafted cpio archive, a remote attacker could use this issue to cause GNU cpio to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-2037)

Record
USN-2906-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 26 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open