usn-5446-1
Medium
Canonical Ubuntu
Max Justicz discovered that dpkg incorrectly handled unpacking certain source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or potentially gaining access to the system. Update Instructions: Run sudo ua fix USN-5446-1
to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: dpkg-dev – 1.19.0.5ubuntu2.4 dselect – 1.19.0.5ubuntu2.4 libdpkg-dev – 1.19.0.5ubuntu2.4 dpkg – 1.19.0.5ubuntu2.4 libdpkg-perl – 1.19.0.5ubuntu2.4 No subscription required
CVEs contained in this USN include: CVE-2022-1664.
Severity is medium unless otherwise noted.
Users of affected products are strongly encouraged to follow the mitigations below.
The Cloud Foundry project recommends upgrading the following releases:
2022-07-28: Initial vulnerability report published.
CPE | Name | Operator | Version |
---|---|---|---|
bionic stemcells | lt | 1.87 | |
cflinuxfs3 | lt | 0.301.0 | |
cf deployment | lt | 21.0.0 |