(RHSA-2015:2108) Moderate: cpio security and bug fix update

The cpio packages provide the GNU cpio utility for creating and extracting
archives, or copying files from one place to another.

A heap-based buffer overflow flaw was found in cpio’s list_file() function.
An attacker could provide a specially crafted archive that, when processed
by cpio, would crash cpio, or potentially lead to arbitrary code execution.
(CVE-2014-9112)

This update fixes the following bugs:

• Previously, during archive creation, cpio internals did not detect a
  read() system call failure. Based on the premise that the call succeeded,
  cpio terminated unexpectedly with a segmentation fault without processing
  further files. The underlying source code has been patched, and an archive
  is now created successfully. (BZ#1138148)

• Previously, running the cpio command without parameters on Red Hat
  Enterprise Linux 7 with Russian as the default language resulted in an
  error message that was not accurate in Russian due to an error in spelling.
  This has been corrected and the Russian error message is spelled correctly.
  (BZ#1075513)

All cpio users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.