Summary
Jann Horn discovered that dpkg incorrectly validated signatures when
extracting local source packages. If a user or an automated system were
tricked into unpacking a specially crafted source package, a remote
attacker could bypass signature verification checks.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | dpkg | 1.17.5ubuntu5.4 |
Vulnerabilities 1
-
Unscored —
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signa…
References
-
report
https://ubuntu.com/security/CVE-2015-0840