CVE-1999-1572: Debian Linux

Low severity, CVSS 2.1. EPSS: 0.6% chance of exploitation in the next 30 days.

cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.

Affected products

• Debian Debian Linux: version 3.0 only
• Freebsd Freebsd: version 2.1.0 only
• Mandrakesoft Mandrake Linux: version 9.2 only; version 10.0 only; version 10.1 only; version cs2.1 only; version cs3.0 only
• Red Hat Enterprise Linux: version 4.0 only
• Red Hat Enterprise Linux Desktop: version 4.0 only
• Ubuntu Ubuntu Linux: version 4.10 only

Published 1996-07-16. Last modified 2026-06-16.