Summary
USN-2183-1 fixed a vulnerability in dpkg. Javier Serrano Polo discovered
that the fix introduced a vulnerability in releases with an older version
of the patch utility. This update fixes the problem.
Original advisory details:
Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when
unpacking source packages. If a user or an automated system were tricked
into unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial of
service or potentially gaining access to the system.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | dpkg | 1.17.5ubuntu5.2 |
Vulnerabilities 1
-
Unscored —
Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17…
References
-
report
https://ubuntu.com/security/CVE-2014-0471