dpkg vulnerability

2011-01-0600:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.4

Confidence

Low

EPSS

0.02

Percentile

88.8%

JSON

Releases

Ubuntu 10.10
Ubuntu 10.04
Ubuntu 9.10

Packages

dpkg - Debian package management system

Details

Jakub Wilk and Raphael Hertzog discovered that dpkg-source did not
correctly handle certain paths and symlinks when unpacking source-format
version 3.0 packages. If a user or an automated system were tricked into
unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial
of service or potentially gaining access to the system.

OSVersionArchitecturePackageVersionFilename
Ubuntu9.10noarchdpkg-dev< 1.15.4ubuntu2.3UNKNOWN
Ubuntu9.10noarchdpkg< 1.15.4ubuntu2.3UNKNOWN
Ubuntu9.10noarchdselect< 1.15.4ubuntu2.3UNKNOWN
Ubuntu10.10noarchdpkg-dev< 1.15.8.4ubuntu3.1UNKNOWN
Ubuntu10.10noarchdpkg< 1.15.8.4ubuntu3.1UNKNOWN
Ubuntu10.10noarchdselect< 1.15.8.4ubuntu3.1UNKNOWN
Ubuntu10.10noarchlibdpkg-dev< 1.15.8.4ubuntu3.1UNKNOWN
Ubuntu10.04noarchdpkg-dev< 1.15.5.6ubuntu4.5UNKNOWN
Ubuntu10.04noarchdpkg< 1.15.5.6ubuntu4.5UNKNOWN
Ubuntu10.04noarchdselect< 1.15.5.6ubuntu4.5UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.10	noarch	dpkg-dev	< 1.15.4ubuntu2.3	UNKNOWN
Ubuntu	9.10	noarch	dpkg	< 1.15.4ubuntu2.3	UNKNOWN
Ubuntu	9.10	noarch	dselect	< 1.15.4ubuntu2.3	UNKNOWN
Ubuntu	10.10	noarch	dpkg-dev	< 1.15.8.4ubuntu3.1	UNKNOWN
Ubuntu	10.10	noarch	dpkg	< 1.15.8.4ubuntu3.1	UNKNOWN
Ubuntu	10.10	noarch	dselect	< 1.15.8.4ubuntu3.1	UNKNOWN
Ubuntu	10.10	noarch	libdpkg-dev	< 1.15.8.4ubuntu3.1	UNKNOWN
Ubuntu	10.04	noarch	dpkg-dev	< 1.15.5.6ubuntu4.5	UNKNOWN
Ubuntu	10.04	noarch	dpkg	< 1.15.5.6ubuntu4.5	UNKNOWN
Ubuntu	10.04	noarch	dselect	< 1.15.5.6ubuntu4.5	UNKNOWN