vulnerabilities in busybox tar and cpio tools

[Ian Norton <Ian.Norton () entrust com>]

https://bugs.busybox.net/show_bug.cgi?id=16018  (awaiting CVE)

Busybox's cpio and tar tools will print un-escaped filenames when listing and unpacking
cpio and tar files. Malicious files containing filenames with terminal escapes can be used
to mask or modify earlier or later files in the archive from anyone running busybox tar or cpio
from a terminal.

see also https://lists.busybox.net/pipermail/busybox/2024-July/090806.html


https://security-tracker.debian.org/tracker/CVE-2023-39810

A unpacking a cpio archive can escape the working directory. Due to #16018 it is possible to
mask these traversals from anyone using cpio to inspect a file before unpacking.

see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html




Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom 
they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the 
information it contains. Please notify Entrust immediately and delete the message from your system.