CVE catalog

CVE-2019-14866

cpio: CVE-2019-14866

[CVE catalog]

Severity
Medium · CVSS 6.7CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.69% · Oct 25, 2026

In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancpiosid2.15+dfsg-2.1fixed
Debiancpioforky2.15+dfsg-2.1fixed
Debiancpiotrixie2.15+dfsg-2fixed
Debiancpiobookworm2.13+dfsg-7.1fixed
Ubuntucpiopro2.11+dfsg-1ubuntu1vulnerable
Ubuntucpiopro2.11+dfsg-1ubuntu1.1vulnerable
Ubuntucpiopro2.11+dfsg-1ubuntu1.2vulnerable
Ubuntucpiopro2.11+dfsg-1ubuntu1.2+esm1fixed
Ubuntucpio16.042.11+dfsg-4.1ubuntu1vulnerable
Ubuntucpio16.042.11+dfsg-5ubuntu1vulnerable
Ubuntucpio16.042.11+dfsg-5ubuntu1.1fixed
Ubuntucpio18.042.11+dfsg-6vulnerable
Ubuntucpio18.042.12+dfsg-6vulnerable
Ubuntucpio18.042.12+dfsg-6ubuntu0.18.04.1fixed
Susecpiolinux enterprise desktop 12 sp42.11-36.6.1fixed
Susecpiolinux enterprise server 12 sp42.11-36.6.1fixed
Susecpiolinux enterprise server for sap applications 12 sp42.11-36.6.1fixed
Susecpiolinux enterprise server 12 sp52.11-36.6.1fixed
Susecpiolinux enterprise server for sap applications 12 sp52.11-36.6.1fixed
Opensusecpioleap 15.02.12-lp150.2.3.1fixed
Susecpiolinux enterprise module for basesystem 152.12-3.3.1fixed
Susecpiolinux enterprise module for basesystem 15 sp12.12-3.3.1fixed
Opensusecpioleap 15.12.12-lp151.3.3.1fixed
Ubuntucpiopro2.11+dfsg-1ubuntu1vulnerable
Ubuntucpiopro2.11+dfsg-1ubuntu1.1vulnerable
Ubuntucpiopro2.11+dfsg-1ubuntu1.2vulnerable
Ubuntucpiopro2.11+dfsg-1ubuntu1.2+esm1fixed
Ubuntucpio16.042.11+dfsg-4.1ubuntu1vulnerable
Ubuntucpio16.042.11+dfsg-5ubuntu1vulnerable
Ubuntucpio16.042.11+dfsg-5ubuntu1.1fixed
Ubuntucpio18.042.11+dfsg-6vulnerable
Ubuntucpio18.042.12+dfsg-6vulnerable
Ubuntucpio18.042.12+dfsg-6ubuntu0.18.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancpiosourcesid2.13+dfsg-1lowNot reported[941412]
Debiancpiosourceforky2.13+dfsg-1lowNot reported[941412]
Debiancpiosourcetrixie2.13+dfsg-1lowNot reported[941412]
Debiancpiosourcebookworm2.13+dfsg-1lowNot reported[941412]
Ubuntucpiodebpro2.11+dfsg-1ubuntu1.2+esm1Not reportedUSN-4176-1Not reported
Ubuntucpiodeb16.042.11+dfsg-5ubuntu1.1Not reportedUSN-4176-1Not reported
Ubuntucpiodeb18.042.12+dfsg-6ubuntu0.18.04.1Not reportedUSN-4176-1Not reported
Susecpiorpmlinux enterprise desktop 12 sp42.11-36.6.1Not reportedSUSE-SU-2019:3064-1Not reported
Susecpiorpmlinux enterprise server 12 sp42.11-36.6.1Not reportedSUSE-SU-2019:3064-1Not reported
Susecpiorpmlinux enterprise server for sap applications 12 sp42.11-36.6.1Not reportedSUSE-SU-2019:3064-1Not reported
Susecpiorpmlinux enterprise server 12 sp52.11-36.6.1Not reportedSUSE-SU-2019:3064-1Not reported
Susecpiorpmlinux enterprise server for sap applications 12 sp52.11-36.6.1Not reportedSUSE-SU-2019:3064-1Not reported
Opensusecpiorpmleap 15.02.12-lp150.2.3.1Not reportedOPENSUSE-SU-2019:2593-1Not reported
Susecpiorpmlinux enterprise module for basesystem 152.12-3.3.1Not reportedSUSE-SU-2019:3059-1Not reported
Susecpiorpmlinux enterprise module for basesystem 15 sp12.12-3.3.1Not reportedSUSE-SU-2019:3059-1Not reported
Opensusecpiorpmleap 15.12.12-lp151.3.3.1Not reportedOPENSUSE-SU-2019:2596-1Not reported
Ubuntucpiodebpro2.11+dfsg-1ubuntu1.2+esm1Not reportedUBUNTU-CVE-2019-14866Not reported
Ubuntucpiodeb16.042.11+dfsg-5ubuntu1.1Not reportedUBUNTU-CVE-2019-14866Not reported
Ubuntucpiodeb18.042.12+dfsg-6ubuntu0.18.04.1Not reportedUBUNTU-CVE-2019-14866Not reported

[Debian bug #941412]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [cpio]Fixed
    Details (2)

    • 2.13+dfsg-7.1 · amd64 · bookworm

      Fixed · Fixed: 2.13+dfsg-1

      dsa · cpio · debian · bookworm; dsa · cpio · debian · 12

    • 2.13+dfsg-7.1 · arm64 · bookworm

      Fixed · Fixed: 2.13+dfsg-1

      dsa · cpio · debian · bookworm; dsa · cpio · debian · 12

  • [cpio-win32]Fixed

    Source package: [cpio]

    Details (2)

    • 2.13+dfsg-7.1 · all · bookworm

      Fixed · Fixed: 2.13+dfsg-1

      dsa · cpio · debian · bookworm; dsa · cpio · debian · 12

    • 2.13+dfsg-7.1 · all · bookworm

      Fixed · Fixed: 2.13+dfsg-1

      dsa · cpio · debian · bookworm; dsa · cpio · debian · 12

[Debian 13 (Trixie)]

  • [cpio]Fixed
    Details (2)

    • 2.15+dfsg-2 · amd64 · trixie

      Fixed · Fixed: 2.13+dfsg-1

      dsa · cpio · debian · 13

    • 2.15+dfsg-2 · arm64 · trixie

      Fixed · Fixed: 2.13+dfsg-1

      dsa · cpio · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]