CVE-2005-1111: Canonical Ubuntu Linux

Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.

Affected products

• Canonical Ubuntu Linux: version 4.10 only; version 5.04 only
• Debian Debian Linux: version 3.0 only; version 3.1 only
• GNU Cpio: up to and including 2.6

Published 2005-05-02. Last modified 2026-06-16.