CVE-2014-3127
HighSummary
Dpkg version 1.15.9 on Debian squeeze introduces support for the 'C-style encoded filenames' feature without recognizing that the squeeze patch program lacks this feature. This leads to an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package.
Risk Assessment
Attackers can exploit this vulnerability to gain access to sensitive files on the system, potentially leading to serious security breaches and data integrity loss.
Recommendation
It is recommended to update dpkg to the latest version that fixes this vulnerability and to review the system configuration to minimize the risk of directory traversal attacks.
Other vulnerabilities in dpkg
See all- CVE-2017-8283Critical
The dpkg-source program in versions 1.3.0 through 1.18.23 allows the use of a non-GNU patch program and does not provide a protection mechanism for blank-indented diff hunks, enabling remote attackers to conduct directory traversal attacks via a crafted Debian source package.
- CVE-2025-6297High
It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup.
Original NVD description (English source)
dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.