oss-security - Re: vulnerabilities in busybox tar and cpio tools

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aAlR1aTrs_8mvChM@eldamar.lan>
Date: Wed, 23 Apr 2025 22:47:17 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: vulnerabilities in busybox tar and cpio tools

Hi,

On Wed, Apr 23, 2025 at 02:11:44PM +0000, Ian Norton wrote:
> 
> https://bugs.busybox.net/show_bug.cgi?id=16018  (awaiting CVE)
> 
> Busybox's cpio and tar tools will print un-escaped filenames when listing and unpacking
> cpio and tar files. Malicious files containing filenames with terminal escapes can be used
> to mask or modify earlier or later files in the archive from anyone running busybox tar or cpio
> from a terminal.

FTR, this one has assigned CVE-2025-46394 .

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.