CVE-2014-3227 in dpkg
Summary
dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
05/06/2014
Disclosure
05/30/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 13404 | dpkg Filename path traversal | 22 | Proof-of-Concept | Official fix | CVE-2014-3227 |