[ubuntu/jammy-security] cpio 2.13+dfsg-7ubuntu0.2 (Accepted)

[John Breton]

cpio (2.13+dfsg-7ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Unbounded stack allocation
    - debian/patches/CVE-2026-66485.patch: Minor fixes in src/makepath.c,
      src/userspec.c.
    - CVE-2026-66485
  * SECURITY UPDATE: Hard link to file outside intended directory
    - debian/patches/CVE-2026-66484.patch: The --no-absolute-filenames option
      affects hard link targets too. in src/tar.c.
    - CVE-2026-66484
  * SECURITY UPDATE: Unescaped output
    - debian/patches/CVE-2026-66486.patch: Quote file names in error messages
      and in listings. in src/copyin.c, src/copyout.c, src/copypass.c,
      src/main.c, tests/CVE-2019-14866.at, tests/testsuite.
    - CVE-2026-66486

Date: 2026-08-18 21:07:11.619748+00:00
Changed-By: Isabel Garcia <isabel.garcia at canonical.com>
Signed-By: John Breton <john.breton at canonical.com>
https://launchpad.net/ubuntu/+source/cpio/2.13+dfsg-7ubuntu0.2
-------------- next part --------------
Sorry, changesfile not available.