CVE-2021-38185

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-38185
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38185.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-38185
Downstream
ALPINE (1)
ALSA (1)
AZL (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (1)
RLSA (1)
SUSE (7)
UBUNTU (1)
Related
ALSA (1)
openSUSE (1)
SUSE (7)
Published
2021-08-08T00:15:07Z
Modified
2026-11-11T02:45:22Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data.

References

Affected packages

Git / cgit.git.savannah.gnu.org/cgit/cpio.git

Affected ranges

Type
GIT
Repo
https://cgit.git.savannah.gnu.org/cgit/cpio.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dd96882877721703e19272fe25034560b794061b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "dd96882877721703e19272fe25034560b794061b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38185.json"

Git / https.git.savannah.gnu.org/git/cpio.git/

Affected ranges

Type
GIT
Repo
https://https.git.savannah.gnu.org/git/cpio.git/
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
cd892d109a583e3a29e1da66b8374c29605bfdc8
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gnu:cpio:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "2.13"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

Other
release_2_11
release_2_12
release_2_13
release_2_6
release_2_7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38185.json"