[USN-2906-1] GNU cpio vulnerabilities
marc.deslauriers at canonical.com
Mon Feb 22 18:57:24 UTC 2016
Ubuntu Security Notice USN-2906-1
February 22, 2016
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Several security issues were fixed in GNU cpio.
- cpio: a tool to manage archives of files
Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic
links when used with the --no-absolute-filenames option. If a user or
automated system were tricked into extracting a specially-crafted cpio
archive, a remote attacker could possibly use this issue to write arbitrary
files. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
Gustavo Grieco discovered that GNU cpio incorrectly handled memory when
extracting archive files. If a user or automated system were tricked into
extracting a specially-crafted cpio archive, a remote attacker could use
this issue to cause GNU cpio to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2016-2037)
The problem can be corrected by updating your system to the following
Ubuntu 14.04 LTS:
Ubuntu 12.04 LTS:
In general, a standard system update will make all the necessary changes.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the ubuntu-security-announce