CVE-2015-1197

Description

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Risk Information

Base Score

4.0

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Score

Exploitation Probability

3.377

Associated Vulnerability

Vulnerability	OS Platform
a program to manage archives of files (USN-2456-1) cpio_2.11-7ubuntu3.2_i386.deb	Linux
a program to manage archives of files (USN-2456-1) cpio_2.11-7ubuntu3.2_amd64.deb	Linux
a program to manage archives of files (USN-2456-1) cpio_2.11+dfsg-1ubuntu1.2_i386.deb	Linux
a program to manage archives of files (USN-2456-1) cpio_2.11+dfsg-1ubuntu1.2_amd64.deb	Linux
cpio Security Update (ALAS-2024-2489) cpio-2.12-11.amzn2.0.1.x86_64.rpm	Linux
cpio Security Update (ALAS-2024-557) cpio-2.13-13.amzn2023.0.3.x86_64.rpm	Linux
cpio Security Update (ALAS2-2024-2489) cpio-2.12-11.amzn2.0.1.x86_64.rpm	Linux
cpio Security Update (ALAS2023-2024-557) cpio-2.13-13.amzn2023.0.3.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234