Skip to content
OpenAdvisories
Unscored USN-2183-2 1 CVE

dpkg vulnerability

Published May 1, 2014 · Updated Apr 22, 2026

Summary

USN-2183-1 fixed a vulnerability in dpkg. Javier Serrano Polo discovered
that the fix introduced a vulnerability in releases with an older version
of the patch utility. This update fixes the problem.

Original advisory details:

Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when
unpacking source packages. If a user or an automated system were tricked
into unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial of
service or potentially gaining access to the system.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS dpkg 1.17.5ubuntu5.2

Vulnerabilities 1

  • Unscored —

    Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17…

References

  • report
    https://ubuntu.com/security/CVE-2014-0471