CVE-2015-1197
First published: Mon Jan 05 2015(Updated: )
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/cpio | 2.13+dfsg-7.1~deb11u1 2.13+dfsg-7.1 2.15+dfsg-2 | |
| GNU Cpio | =2.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2015-1197
- https://marc.info/?l=oss-security&m=142289947619786&w=2
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669
- http://www.securityfocus.com/bid/71914
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:066
- http://www.openwall.com/lists/oss-security/2015/01/18/7
- http://www.ubuntu.com/usn/USN-2906-1
- http://advisories.mageia.org/MGASA-2015-0080.html
- http://www.openwall.com/lists/oss-security/2015/01/07/5
- https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
- http://www.openwall.com/lists/oss-security/2023/12/21/8
- http://www.openwall.com/lists/oss-security/2023/12/27/1
- https://bugzilla.suse.com/attachment.cgi?id=599460&action=diff
- https://git.savannah.gnu.org/cgit/cpio.git/commit/?id=45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca
- https://bugs.debian.org/946267
Frequently Asked Questions
What is the severity of CVE-2015-1197?
CVE-2015-1197 is classified as a medium severity vulnerability due to its potential for local users to exploit the symlink attack.
How do I fix CVE-2015-1197?
To fix CVE-2015-1197, upgrade GNU cpio to version 2.13 or later.
Who is affected by CVE-2015-1197?
Local users of GNU cpio version 2.11 are affected by CVE-2015-1197.
What is the impact of CVE-2015-1197?
The impact of CVE-2015-1197 allows local users to write to arbitrary files through a symlink attack.
What versions of GNU cpio are vulnerable to CVE-2015-1197?
GNU cpio version 2.11 is specifically vulnerable to CVE-2015-1197.
- agent/type
- collector/debian-bugs
- source/Debian
- alias/CVE-2015-1197
- agent/first-publish-date
- agent/references
- agent/severity
- agent/event
- agent/description
- collector/security-tracker-debian
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/author
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/softwarecombine
- package-manager/debian
- vendor/gnu
- canonical/ubuntu cpio
- version/ubuntu cpio/2.11