DSA-3111-1 cpio -- security update

Related Vulnerabilities: CVE-2014-9112  

Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and null pointer dereference issues. For the stable distribution (wheezy), this problem has been fixed in version 2.11+dfsg-0.1+deb7u1. For the upcoming stable distribution (jessie), this problem will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 2.11+dfsg-4. We recommend that you upgrade your cpio packages.

Debian Security Advisory

DSA-3111-1 cpio -- security update

Date Reported:
22 Dec 2014
Affected Packages:
cpio
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 772793.
In Mitre's CVE dictionary: CVE-2014-9112.
More information:

Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and null pointer dereference issues.

For the stable distribution (wheezy), this problem has been fixed in version 2.11+dfsg-0.1+deb7u1.

For the upcoming stable distribution (jessie), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 2.11+dfsg-4.

We recommend that you upgrade your cpio packages.