CVE-2005-1111
Fixed in a distro release EPSS <1%
Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.
Products: gnu cpio, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cpio | 2.6-6 |
| Debian 13 | cpio | 2.6-6 |
| Debian 14 | cpio | 2.6-6 |
| Debian 3.0 | cpio | 2.4.2-39woody2 |
| Debian 3.1 | cpio | 2.5-1.3 |
| Red Hat Enterprise Linux 3 | cpio | 0:2.5-4.RHEL3 |
| Red Hat Enterprise Linux 3 | cpio-debuginfo | 0:2.5-4.RHEL3 |
| Red Hat Enterprise Linux 4 | cpio | 0:2.5-8.RHEL4 |
| Red Hat Enterprise Linux 4 | cpio-debuginfo | 0:2.5-8.RHEL4 |