shield Security update for cpio

SUSE-SLE-Micro-5.4-2026-4012

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856). - CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of service via crafted archives (bsc#1274857). - CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

• Release Date
  Sep 7 2026
• References
  Bugzilla: 1274856, 1274857, 1274858
  CVEs: CVE-2026-66484, CVE-2026-66485, CVE-2026-66486
• Type
  security
• Severity
  moderate

cloud_download Downloads

SUSE Linux Enterprise Micro 5.4 s390x

• Packages
  cpio
  A Backup and Archiving Utility

  2.13-150400.3.10.1 lock rpm lock src

SUSE Linux Enterprise Micro 5.4 aarch64

• Packages
  cpio
  A Backup and Archiving Utility

  2.13-150400.3.10.1 lock rpm lock src

SUSE Linux Enterprise Micro 5.4 x86_64

• Packages
  cpio
  A Backup and Archiving Utility

  2.13-150400.3.10.1 lock rpm lock src