Skip to content
OpenAdvisories
Unscored USN-5446-2 1 CVE

dpkg vulnerability

Published May 30, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-5446-1 fixed a vulnerability in dpkg. This update provides
the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Max Justicz discovered that dpkg incorrectly handled unpacking certain
source packages. If a user or an automated system were tricked into
unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial of
service or potentially gaining access to the system.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS dpkg 1.18.4ubuntu1.7+esm1

Vulnerabilities 1

  • Unscored —
    CVE-2022-1664

    directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar

    Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a …

    Debian dpkg dpkg dpkg Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2022-1664