Skip to content
OpenAdvisories
High USN-7768-1 1 CVE

dpkg vulnerability

Published Sep 24, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that dpkg incorrectly handled removing certain temporary
directories. An attacker could possibly use this issue to consume disk
space, leading to a denial of service.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS dpkg 1.21.1ubuntu2.6
Ubuntu · 24.04 LTS 24.04:LTS dpkg 1.22.6ubuntu6.5

Vulnerabilities 1

  • High 8.2
    CVE-2025-6297

    dpkg-deb: Fix cleanup for control member with restricted directories

    It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behi…

    Debian dpkg dpkg dpkg Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2025-6297