1.25. cpio
1.25.1. RHSA-2010:0144: Moderate security update
Important
This update has already been released (prior to the GA of this release) as the security errata RHSA-2010:0144
This update has been rated as having moderate security impact by the Red Hat Security Response Team.
GNU cpio copies files into or out of a cpio or tar archive.
A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially-crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio. (CVE-2010-0624)
Red Hat would like to thank Jakob Lell for responsibly reporting the CVE-2010-0624 issue.
A denial of service flaw was found in the way cpio expanded archive files. If a user expanded a specially-crafted archive, it could cause the cpio executable to crash. (CVE-2007-4476)
Users of cpio are advised to upgrade to this updated package, which contains backported patches to correct these issues.
