17 results · Feed
-
High 7.5
It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate …
-
High 8.2
dpkg-deb: Fix cleanup for control member with restricted directories
It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behi…
-
Unscored —
directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar
Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a …
-
Unscored —
dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechan…
-
Unscored —
Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x befo…
-
Unscored —
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signa…
-
Unscored —
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remo…
-
Unscored —
Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of t…
-
Unscored —
dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for t…
-
Unscored —CVE-2014-3865 Public exploit
Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files ou…
-
Unscored —
dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that t…
-
Unscored —
Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17…
-
Unscored —
dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via a sym…
-
Unscored —
Directory traversal vulnerability in dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attacker…
-
Unscored —
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which m…
-
Unscored —
Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify…
-
Unscored —
zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed strea…