Directory Traversal Vulnerability in Dpkg Utility on Debian
CVE-2014-3127

Currently unrated

Key Information:

Vendor
Debian
Status
Dpkg
Vendor
CVE Published:
14 May 2014

Summary

The vulnerability in Dpkg 1.15.9 on Debian squeeze allows remote attackers to exploit a flaw in the handling of C-style encoded filenames. As the patch program does not support this feature, it can lead to directory traversal attacks that permit unauthorized modification of files outside their intended directories when processing a specially crafted source package.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306
x_refsource_CONFIRM
http://metadata.ftp-master.debian.org/changelogs//main/d/...
x_refsource_CONFIRM
http://seclists.org/oss-sec/2014/q2/191
mailing-listx_refsource_MLIST

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.