CVE-2015-1197

Severity

19%

Complexity

34%

Confidentiality

48%

CWE-61: UNIX Symbolic Link (Symlink) Following

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

CWE-61: UNIX Symbolic Link (Symlink) Following

CVSS 2.0 Base Score 1.9. CVSS Attack Vector: local. CVSS Attack Complexity: medium. CVSS Vector: (AV:L/AC:M/Au:N/C:N/I:P/A:N).

Overview

First reported 10 years ago

2015-02-19 15:59:00

Last updated 8 years ago

2016-12-06 02:59:00

Affected Software

GNU cpio 2.11

2.11

References

http://advisories.mageia.org/MGASA-2015-0080.html

MDVSA-2015:066

[oss-security] 20150108 Directory traversals in cpio and friends?

Exploit

[oss-security] 20150118 Re: CVE Request: cpio -- directory traversal

71914

USN-2906-1

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669

Exploit

[Bug-cpio] 20150108 cpio: directory traversal vulnerability via symlinks

Exploit

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.