[ubuntu/resolute-security] cpio 2.15+dfsg-2.1ubuntu0.1 (Accepted)

[John Breton]

cpio (2.15+dfsg-2.1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Unbounded stack allocation
    - debian/patches/CVE-2026-66485.patch: Minor fixes in src/makepath.c,
      src/userspec.c.
    - CVE-2026-66485
  * SECURITY UPDATE: Hard link to file outside intended directory
    - debian/patches/CVE-2026-66484.patch: The --no-absolute-filenames option
      affects hard link targets too. in src/tar.c.
    - CVE-2026-66484
  * SECURITY UPDATE: Unescaped output
    - debian/patches/CVE-2026-66486.patch: Quote file names in error messages
      and in listings. in src/copyin.c, src/copyout.c, src/copypass.c,
      src/main.c, tests/CVE-2019-14866.at.
    - CVE-2026-66486

Date: 2026-08-18 20:18:11.494565+00:00
Changed-By: Isabel Garcia <isabel.garcia at canonical.com>
Signed-By: John Breton <john.breton at canonical.com>
https://launchpad.net/ubuntu/+source/cpio/2.15+dfsg-2.1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.