EUVD-2017-17245

Malware in sbrugna...

CVE-2017-8283: Improper Limitation of a Pathname to a Restricted Directory

dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source...

PT-2017-18259

Name of the Vulnerable Software and Affected Versions dpkg versions 1.3.0 through 1.18.23 Description The issue allows remote attackers to conduct directory traversal attacks via a crafted Debian source package. This is possible because dpkg-source in dpkg does not offer a protection mechanism fo...