Lucene search

K
mageiaGentoo FoundationMGASA-2014-0289
HistoryJul 09, 2014 - 2:47 a.m.

Updated dpkg packages fixes security vulnerabilities

2014-07-0902:47:58
Gentoo Foundation
advisories.mageia.org
6

0.159 Low

EPSS

Percentile

96.0%

Jakub Wilk discovered that dpkg did not correctly parse C-style filename quoting, allowing for paths to be traversed when unpacking a source package, leading to the creation of files outside the directory of the source being unpacked (CVE-2014-0471). Multiple vulnerabilities were discovered in dpkg that allow file modification through path traversal when unpacking source packages with especially-crafted patch files (CVE-2014-3864, CVE-2014-3865).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchdpkg< 1.16.15-1.1dpkg-1.16.15-1.1.mga3
Mageia4noarchdpkg< 1.17.10-1.1dpkg-1.17.10-1.1.mga4