CVE-2005-1111

Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.

References

Affected packages

Debian:11 / cpio

Package

Name: cpio
Purl: pkg:deb/debian/cpio?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6-6

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / cpio

Package

Name: cpio
Purl: pkg:deb/debian/cpio?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6-6

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / cpio

Package

Name: cpio
Purl: pkg:deb/debian/cpio?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6-6

Ecosystem specific

{
    "urgency": "low"
}