CVE-2019-14866
Publication date 2 November 2019
Last updated 25 August 2025
Ubuntu priority
Description
In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cpio | ||
| 18.04 LTS bionic |
Fixed 2.12+dfsg-6ubuntu0.18.04.1
|
|
| 16.04 LTS xenial |
Fixed 2.11+dfsg-5ubuntu1.1
|
|
| 14.04 LTS trusty |
Fixed 2.11+dfsg-1ubuntu1.2+esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialPatch details
| Package | Patch details |
|---|---|
| cpio |
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.3 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-4176-1
- GNU cpio vulnerability
- 6 November 2019