CVE-2017-8283
CriticalSummary
The dpkg-source program in versions 1.3.0 through 1.18.23 allows the use of a non-GNU patch program and does not provide a protection mechanism for blank-indented diff hunks, enabling remote attackers to conduct directory traversal attacks via a crafted Debian source package.
Risk Assessment
An attacker could exploit this vulnerability to gain access to unauthorized directories on the system, potentially leading to the disclosure of sensitive data or the installation of malicious software.
Recommendation
It is recommended to update dpkg to the latest version to mitigate the risks associated with this vulnerability and to monitor systems for suspicious activities.
Original NVD description (English source)
dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.