Debian Security Advisory
DSA-3111-1 cpio -- security update
- Date Reported:
- 22 Dec 2014
- Affected Packages:
- cpio
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 772793.
In Mitre's CVE dictionary: CVE-2014-9112. - More information:
-
Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and null pointer dereference issues.
For the stable distribution (wheezy), this problem has been fixed in version 2.11+dfsg-0.1+deb7u1.
For the upcoming stable distribution (jessie), this problem will be fixed soon.
For the unstable distribution (sid), this problem has been fixed in version 2.11+dfsg-4.
We recommend that you upgrade your cpio packages.