CVE-2021-38185
published 2021-08-08CVE-2021-38185: GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers…
high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | cpio | < cpio 2.13+dfsg-5 (bookworm) | cpio 2.13+dfsg-5 (bookworm) |
| gnu | cpio | <= 2.13 | — |
| gnu | cpio | >= 0 < 2.13+dfsg-7.1~deb11u1 | 2.13+dfsg-7.1~deb11u1 |
| gnu | cpio | >= 0 < 2.13+dfsg-5 | 2.13+dfsg-5 |
| gnu | cpio | >= 0 < 2.13+dfsg-5 | 2.13+dfsg-5 |
| gnu | cpio | >= 0 < 2.13+dfsg-5 | 2.13+dfsg-5 |
| msrc | cbl2_cpio_2.13-4_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_cpio_2.13-3_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH