Fabrice Fontaine 94bd3fa36c package/cpio: fix CVE-2021-38185 ...

GNU cpio through 2.13 allows attackers to execute arbitrary code via a
crafted pattern file, because of a dstring.c ds_fgetstr integer overflow
that triggers an out-of-bounds heap write. NOTE: it is unclear whether
there are common cases where the pattern file, associated with the -E
option, is untrusted data.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 89857df2d1233f60ca7702b387d8e2a17e125d23)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

2021-09-06 17:06:38 +02:00

1.1 KiB

Raw Permalink Blame History

View Raw