shield Security update for cpio

SUSE-SLE-Module-Basesystem-15-SP7-2026-4012

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives (bsc#1274856). - CVE-2026-66485: improper memory management in the `make_path` function when allocating memory allows for denial of service via crafted archives (bsc#1274857). - CVE-2026-66486: improper encoding or escaping of output in the archive member listing functionality allows for terminal control sequence injection via crafted archive member names (bsc#1274858).

• Release Date
  Sep 7 2026
• References
  Bugzilla: 1274856, 1274857, 1274858
  CVEs: CVE-2026-66484, CVE-2026-66485, CVE-2026-66486
• Type
  security
• Severity
  moderate

cloud_download Downloads

Basesystem Module 15.7 ppc64le

• Packages
  cpio
  A Backup and Archiving Utility

  2.13-150400.3.10.1 lock rpm lock src

  cpio-lang
  Translations for package cpio

  2.13-150400.3.10.1 lock rpm

  cpio-mt
  Tape drive control utility

  2.13-150400.3.10.1 lock rpm

Basesystem Module 15.7 s390x

• Packages
  cpio
  A Backup and Archiving Utility

  2.13-150400.3.10.1 lock rpm lock src

  cpio-lang
  Translations for package cpio

  2.13-150400.3.10.1 lock rpm

  cpio-mt
  Tape drive control utility

  2.13-150400.3.10.1 lock rpm

Basesystem Module 15.7 aarch64

• Packages
  cpio
  A Backup and Archiving Utility

  2.13-150400.3.10.1 lock rpm lock src

  cpio-lang
  Translations for package cpio

  2.13-150400.3.10.1 lock rpm

  cpio-mt
  Tape drive control utility

  2.13-150400.3.10.1 lock rpm

Basesystem Module 15.7 x86_64

• Packages
  cpio
  A Backup and Archiving Utility

  2.13-150400.3.10.1 lock rpm lock src

  cpio-lang
  Translations for package cpio

  2.13-150400.3.10.1 lock rpm

  cpio-mt
  Tape drive control utility

  2.13-150400.3.10.1 lock rpm