cpio: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.4360
                   GNU cpio -- multiple vulnerabilities
                             18 November 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           cpio
Publisher:         VuXML
Operating System:  FreeBSD
Impact/Access:     Modify Arbitrary Files -- Remote with User Interaction
                   Denial of Service      -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-14866 CVE-2016-2037 CVE-2015-1197

Reference:         ASB-2016.0017
                   ESB-2019.4171
                   ESB-2019.4094
                   ESB-2017.2550
                   ESB-2016.0423

Original Bulletin: 
   http://www.vuxml.org/freebsd/f59af308-07f3-11ea-8c56-f8b156b6dcc8.html

- --------------------------BEGIN INCLUDED TEXT--------------------

GNU cpio -- multiple vulnerabilities

Affected packages

gcpio < 2.13

Details

VuXML ID f59af308-07f3-11ea-8c56-f8b156b6dcc8

Discovery 2019-11-06

Entry 2019-11-15

Sergey Poznyakoff reports:

This stable release fixes several potential vulnerabilities

CVE-2015-1197: cpio, when using the --no-absolute-filenames option, allows 
local users to write to arbitrary files via a symlink attack on a file in an 
archive.

CVE-2016-2037: The cpio_safer_name_suffix function in util.c allows remote 
attackers to cause a denial of service (out-of-bounds write) via a crafted 
cpio file.

CVE-2019-14866: Improper input validation when writing tar header fields leads
to unexpected tar generation.

[source] References

CVE Name CVE-2015-1197

CVE Name CVE-2016-2037

CVE Name CVE-2019-14866

URL https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXdI2z2aOgq3Tt24GAQiSxg//TAMp+f+GLEzeVEoVYVxZEQyEhNtFEC92
8Iu2swWi7j7oTVUakoYumcqWGkYa4XKXHn04t3DZcrDwEVaORlq/UguKMjpcgh3N
wCMhQazw1kZANxo0tXbNlY40JYmI+6Od8A+ZWtxPlWt5gjQ6KCDy+iy5RnA+eyyK
fT3GKmFG+9AmvjROA+rJpdNMyfA2QCGnilkICxbJyA61ksE1tZePsrBV/eF/+ZRO
phyE0Oiz83TZnqOXl+H6GcXIYf8p9FHsLJs+LLlNfhdsVPnfpBQGbj/q8DljcjsB
7q5tAXkM/nPF5gZ7tH3PYqqwgadxj8DyCvxz8x3BYQRi0IwmYnX/Ut1zl2+qVPJZ
ngFAUOBKbvR6/Fr0oKyDdSGgQvCRSZ7RgNC5uza/cOTdw6N350XiNs50awYc9//3
H52Vc9fm5BSFwNF5o0Eu758zAPWNrckwsLfN4hILPx7+WOUwQjhWSrCpyNRHsovV
9VEeBVxeVczUw8TbuxmCX5i1iiMlrxqXD3Xj+FfHAbprjrK5XA3wskCJRJYeh2QD
+UufVR61oqrh25s446vStpI4vMp78xo3eh6aAuVSU7lxWaD8NmZNwvmGPOiEUhCn
JpbhXbw+/Z/mO5vmw75Jn20A+HkcbFU6svSvavljdxb/Uq03wI7YT/RkIj3e+ZjQ
VGI5HYivdfM=
=H4L5
-----END PGP SIGNATURE-----