Description
Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dpkg | 1.17.22 | — |
| Debian 13 | dpkg | 1.17.22 | — |
| Debian 12 | dpkg | 1.17.22 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | dpkg | No fix yet | — |
References
- [oss-security] 20141106 Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability mailing-list
- dpkg-format-sting(98551) vdb-entry
- FEDORA-2015-6974 vendor-advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768485
- [oss-security] 20141106 CVE-Request: dpkg handling of 'control' and warnings format string vulnerability mailing-list
- https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135
- [oss-security] 20141106 Re: CVE-Request: dpkg handling of 'control' and warnings format string vulnerability mailing-list