Security & Threat Intelligence · 31.08.2026, 16:03 UTC
USN-8704-1: GNU cpio vulnerabilities
| Schweregrad | info |
|---|---|
| CVE | ↗ ↗ ↗ |
| Kategorie | Security & Threat Intelligence |
| Quelle | Ubuntu Security Notices ↗ |
| Veröffentlicht | 31.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2026-66484, CVE-2026-66485, CVE-2026-66486. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the extraction directory, even when using the --no-absolute-filenames option. (CVE-2026-66484)
It was discovered that cpio did not properly bound the stack memory allocated for pathnames during archive extraction. If a user or automated system were tricked into extracting a specially crafted cpio archive, an attacker could possibly use this issue to cause cpio to crash, resulting in a denial of service. (CVE-2026-66485)
It was discovered that cpio did not properly escape archive member names when listing archive contents. If a user or automated system were tricked into listing a specially crafted archive, an attacker could possibly use this issue to inject misleading output or malicious terminal control sequences. (CVE-2026-66486)