MGASA-2014-0289

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0289.html
Import Source
https://advisories.mageia.org/MGASA-2014-0289.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2014-0289
Related
Published
2014-07-08T22:47:58Z
Modified
2014-07-08T22:47:26Z
Summary
Updated dpkg packages fixes security vulnerabilities
Details

Jakub Wilk discovered that dpkg did not correctly parse C-style filename quoting, allowing for paths to be traversed when unpacking a source package, leading to the creation of files outside the directory of the source being unpacked (CVE-2014-0471).

Multiple vulnerabilities were discovered in dpkg that allow file modification through path traversal when unpacking source packages with especially-crafted patch files (CVE-2014-3864, CVE-2014-3865).

References
Credits

Affected packages

Mageia:3 / dpkg

Package

Name
dpkg
Purl
pkg:rpm/mageia/dpkg?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.16.15-1.1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:4 / dpkg

Package

Name
dpkg
Purl
pkg:rpm/mageia/dpkg?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.17.10-1.1.mga4

Ecosystem specific 

{
    "section": "core"
}