Summary
Yashashree Gund discovered that the dpkg dpkg-deb tool incorrectly handled
certain zstd-compressed .deb archives. If a user or automated system were
tricked into manipulating a specially crafted .deb archive, a remote
attacker could possibly use this issue to cause dpkg-deb to stop
responding, resulting in a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | dpkg | 1.22.6ubuntu6.6 |
| Ubuntu · 25.10 | dpkg | 1.22.21ubuntu3.2 |
Vulnerabilities 1
-
High 7.5
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate …
References
-
report
https://ubuntu.com/security/CVE-2026-2219