Lucene search
MitreCVE-2014-3127HistoryMay 14, 2014 - 12:55 a.m.
CVE-2014-3127
2014-05-1400:55:10
CWE-22
mitre
web.nvd.nist.gov
31
dpkg
debian
squeeze
cve-2014-3127
directory traversal
remote attackers
release engineering
nvd
security vulnerability
CVSS2
7.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:N/I:C/A:C
AI Score
6.3
Confidence
Low
EPSS
0.012
Percentile
85.3%
dpkg 1.15.9 on Debian squeeze introduces support for the “C-style encoded filenames” feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.
Affected configurations
Node
debiandpkgMatch1.16.0
ORdebiandpkgMatch1.16.0.1
ORdebiandpkgMatch1.16.0.2
ORdebiandpkgMatch1.16.0.3
ORdebiandpkgMatch1.16.1
ORdebiandpkgMatch1.16.1.1
ORdebiandpkgMatch1.16.1.2
ORdebiandpkgMatch1.16.2
ORdebiandpkgMatch1.16.3
ORdebiandpkgMatch1.16.4
ORdebiandpkgMatch1.16.4.1
ORdebiandpkgMatch1.16.4.2
ORdebiandpkgMatch1.16.4.3
ORdebiandpkgMatch1.16.5
ORdebiandpkgMatch1.16.6
ORdebiandpkgMatch1.16.7
ORdebiandpkgMatch1.16.8
ORdebiandpkgMatch1.16.9
ORdebiandpkgMatch1.16.10
ORdebiandpkgMatch1.16.11
ORdebiandpkgMatch1.16.12
Node
debiandpkgMatch1.17.0
ORdebiandpkgMatch1.17.1
ORdebiandpkgMatch1.17.2
ORdebiandpkgMatch1.17.3
ORdebiandpkgMatch1.17.4
ORdebiandpkgMatch1.17.5
ORdebiandpkgMatch1.17.6
ORdebiandpkgMatch1.17.7
ORdebiandpkgMatch1.17.8
Node
debiandpkgMatch1.15.0
ORdebiandpkgMatch1.15.1
ORdebiandpkgMatch1.15.2
ORdebiandpkgMatch1.15.3
ORdebiandpkgMatch1.15.3.1
ORdebiandpkgMatch1.15.4
ORdebiandpkgMatch1.15.4.1
ORdebiandpkgMatch1.15.5
ORdebiandpkgMatch1.15.5.1
ORdebiandpkgMatch1.15.5.2
ORdebiandpkgMatch1.15.5.3
ORdebiandpkgMatch1.15.5.4
ORdebiandpkgMatch1.15.5.5
ORdebiandpkgMatch1.15.5.6
ORdebiandpkgMatch1.15.6
ORdebiandpkgMatch1.15.6.1
ORdebiandpkgMatch1.15.7
ORdebiandpkgMatch1.15.7.1
ORdebiandpkgMatch1.15.7.2
ORdebiandpkgMatch1.15.8
ORdebiandpkgMatch1.15.8.1
ORdebiandpkgMatch1.15.8.2
ORdebiandpkgMatch1.15.8.3
ORdebiandpkgMatch1.15.8.4
ORdebiandpkgMatch1.15.8.5
ORdebiandpkgMatch1.15.8.6
ORdebiandpkgMatch1.15.8.7
ORdebiandpkgMatch1.15.8.8
ORdebiandpkgMatch1.15.8.9
ORdebiandpkgMatch1.15.8.10
ORdebiandpkgMatch1.15.8.11
ORdebiandpkgMatch1.15.8.12
ORdebiandpkgMatch1.15.8.13
ORdebiandpkgMatch1.15.9
| Vendor | Product | Version | CPE |
|---|---|---|---|
| debian | dpkg | 1.16.0 | cpe:2.3:a:debian:dpkg:1.16.0:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.0.1 | cpe:2.3:a:debian:dpkg:1.16.0.1:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.0.2 | cpe:2.3:a:debian:dpkg:1.16.0.2:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.0.3 | cpe:2.3:a:debian:dpkg:1.16.0.3:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.1 | cpe:2.3:a:debian:dpkg:1.16.1:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.1.1 | cpe:2.3:a:debian:dpkg:1.16.1.1:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.1.2 | cpe:2.3:a:debian:dpkg:1.16.1.2:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.2 | cpe:2.3:a:debian:dpkg:1.16.2:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.3 | cpe:2.3:a:debian:dpkg:1.16.3:*:*:*:*:*:*:* |
| debian | dpkg | 1.16.4 | cpe:2.3:a:debian:dpkg:1.16.4:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2014-3127
2014-05-14 00:00:00
CVE-2014-0471
2014-04-30 14:00:00
ubuntucve
ubuntucve
CVE-2014-3127
2014-05-14 00:00:00
CVE-2014-0471
2014-04-28 00:00:00
debiancve
debiancve
CVE-2014-3127
2014-05-14 00:55:10
CVE-2014-0471
2014-04-30 14:22:06
prion
prion
Directory traversal
2014-05-14 00:55:00
Directory traversal
2014-04-30 14:22:00
nvd
nvd
CVE-2014-3127
2014-05-14 00:55:10
CVE-2014-0471
2014-04-30 14:22:06
openvas
openvas
Debian: Security Advisory (DSA-2915-2)
2014-04-27 00:00:00
Fedora Update for dpkg FEDORA-2014-6277
2014-05-26 00:00:00
Ubuntu: Security Advisory (USN-2183-2)
2014-05-05 00:00:00
osv
osv
dpkg - security update
2014-04-28 00:00:00
dpkg - security update
2014-04-28 00:00:00
securityvulns
securityvulns
[oss-security] Re: CVE request: another path traversal in dpkg-source during unpack
2014-06-13 00:00:00
dpkg directory traversal
2014-06-13 00:00:00
Debian dpkg directory traversal
2014-05-01 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: dpkg-1.16.14-1.fc20
2014-05-21 02:27:50
[SECURITY] Fedora 20 Update: dpkg-1.16.15-1.fc20
2014-07-20 03:23:56
[SECURITY] Fedora 19 Update: dpkg-1.16.15-1.fc19
2014-08-07 15:34:11
nessus
nessus
Debian DSA-2915-1 : dpkg - security update
2014-04-29 00:00:00
Ubuntu 14.04 LTS : dpkg vulnerability (USN-2183-1)
2014-04-29 00:00:00
Ubuntu 14.04 LTS : dpkg vulnerability (USN-2183-2)
2014-05-02 00:00:00
ubuntu
ubuntu
dpkg vulnerability
2014-05-01 00:00:00
dpkg vulnerability
2014-04-28 00:00:00
debian
debian
[SECURITY] [DSA 2915-1] dpkg security update
2014-04-28 11:12:48
cve
cve
CVE-2014-0471
2014-04-30 14:22:06
mageia
mageia
Updated dpkg packages fixes security vulnerabilities
2014-07-09 02:47:58
CVSS2
7.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:N/I:C/A:C
AI Score
6.3
Confidence
Low
EPSS
0.012
Percentile
85.3%
Related for CVE-2014-3127