VDB
GCVE-110-MAGEIA-2015-80
GCVE-110-MAGEIA-2015-80
Advisory Published
In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting
contents of an archive to be strictly inside a current directory. However,
it can be bypassed with symlinks. While extracting an archive, it will
extract symlinks and then follow them if they are referenced in further
entries. This can be exploited by a rogue archive to write files outside
the current directory (CVE-2015-1197).
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Mageia | cpio | 0 (affected), 2.11-6.3.mga4 (unaffected), 2.11-6.3.mga4 (unaffected), 0 (affected) | — |
| Mageia | drakx-net | 0 (affected), 2.22-1.mga4 (unaffected) | — |
References
Browse GCVE Records
73,442 records in the GCVE database · Updated July 17, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.