Red Hat Bugzilla – Bug 1300207
CVE-2016-2037 cpio: out of bounds write
Last modified: 2017-02-17 09:03:10 EST
An out of bounds write was found in a way cpio parses certain cpio files. A specially crafted file can cause the application to crash.
Original bug report with reproducer:
Created cpio tracking bugs for this issue:
Affects: fedora-all [bug 1300208]
may I ask why this issue was closed as "WONTFIX"?
The cpio version in Fedora 22 and RHEL 7 are affected and are not patched.
According to LWN (lwn.net/Vulnerabilities/675700/), the issue is an out-of-bounds-write.
cpio might be invoked by amavisd-new email content scanner.
alright, so there's a tracking bug for Fedora. Mea culpa.
Still RHEL seems affected, too.
It's not uncommon for us to close security issues as WONTFIX if we think that they are not critical enough to warrant an immediate security fix.
If you can provide us with additional information, concerns or further questions, you are welcome to contact us via firstname.lastname@example.org