CVE-2015-1197
Fixed in a distro release EPSS 3%
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Products: gnu cpio
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | cpio | 2.12-11.amzn2.0.1 |
| Amazon Linux 2023 | cpio | 2.13-13.amzn2023.0.3 |
| Debian 12 | cpio | 2.11+dfsg-4.1 |
| Debian 13 | cpio | 2.11+dfsg-4.1 |
| Debian 14 | cpio | 2.11+dfsg-4.1 |
| Ubuntu 14.04 LTS | cpio | 2.11+dfsg-1ubuntu1.2 |
| openSUSE Tumbleweed | cpio | 2.13-3.3 |