Skip to content
OpenAdvisories
Unscored USN-5446-1 1 CVE

dpkg vulnerability

Published May 26, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Max Justicz discovered that dpkg incorrectly handled unpacking certain
source packages. If a user or an automated system were tricked into
unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial of
service or potentially gaining access to the system.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS dpkg 1.19.0.5ubuntu2.4
Ubuntu · 20.04 LTS 20.04:LTS dpkg 1.19.7ubuntu3.2
Ubuntu · 22.04 LTS 22.04:LTS dpkg 1.21.1ubuntu2.1

Vulnerabilities 1

  • Unscored —
    CVE-2022-1664

    directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar

    Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a …

    Debian dpkg dpkg dpkg Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2022-1664