UBUNTU-CVE-2019-14866

    Dashboard / Vulnerabilities / UBUNTU-CVE-2019-14866

    UBUNTU-CVE-2019-14866

    Published: 2 Nov 2019Last Modified: 4 Feb 2026
    Upstream:
    CVE-2019-14866
    Aliases:
    USN-4176-1

    Summary:

    Details: In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

    References: https://ubuntu.com/security/CVE-2019-14866, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14866, https://lists.gnu.org/archive/html/bug-cpio/2019-08/msg00003.html, https://ubuntu.com/security/notices/USN-4176-1, https://www.cve.org/CVERecord?id=CVE-2019-14866

    Affected packages

    Package

    Name: cpio

    Purl: pkg:deb/ubuntu/[email protected]+dfsg-1ubuntu1.2+esm1?arch=source&distro=trusty/esm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.11+dfsg-1ubuntu1.2+esm1

    Affected versions

    2.11+dfsg-1ubuntu1
    2.11+dfsg-1ubuntu1.1
    2.11+dfsg-1ubuntu1.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2019-14866 | CVE-DB