Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:2689-1

Опубликовано: 16 авг. 2021
Источник: suse-cvrf

Описание

Security update for cpio

This update for cpio fixes the following issues:

It was possible to trigger Remote code execution due to a integer overflow (CVE-2021-38185, bsc#1189206)

UPDATE: This update was buggy and could lead to hangs, so it has been retracted. There will be a follow up update.

Список пакетов

openSUSE Leap 15.3
cpio-2.12-3.6.1
cpio-lang-2.12-3.6.1
cpio-mt-2.12-3.6.1

Ссылки

Описание

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.

Затронутые продукты
openSUSE Leap 15.3:cpio-2.12-3.6.1
openSUSE Leap 15.3:cpio-lang-2.12-3.6.1
openSUSE Leap 15.3:cpio-mt-2.12-3.6.1
Ссылки
Уязвимость openSUSE-SU-2021:2689-1