Security Information / 2014 / Security Information -- DSA-3111-1 cpio

Debian Security Advisory

DSA-3111-1 cpio -- security update

Date Reported:

22 Dec 2014

Affected Packages:

cpio

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 772793.
In Mitre's CVE dictionary: CVE-2014-9112.

More information:

Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and null pointer dereference issues.

For the stable distribution (wheezy), this problem has been fixed in version 2.11+dfsg-0.1+deb7u1.

For the upcoming stable distribution (jessie), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 2.11+dfsg-4.

We recommend that you upgrade your cpio packages.