CVE-2015-1197: gnu cpio
Vulnerability summary
CVE-2015-1197 is a low (CVSS 1.9) vulnerability in gnu cpio. EPSS estimates a 2.91% chance of exploitation in the next 30 days, higher than 86.7% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Duplicates 1 · Related 2Timeline
- 19-02-2015PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.91%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.91% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (bugs.debian.org)
Maturity: unknown
Exploit Reference (lists.gnu.org)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
3 vendors · 3 products
References
15 links- www.securityfocus.com/bid/71914VDB Entry
- www.mandriva.com/security/advisories?name=MDVSA-2015:066Vendor Advisory
- www.openwall.com/lists/oss-security/2015/01/18/7Mailing List
- www.ubuntu.com/usn/USN-2906-1Vendor Advisory
- www.openwall.com/lists/oss-security/2023/12/21/8Mailing List
Show all 15 references
- www.openwall.com/lists/oss-security/2023/12/27/1Mailing List