CPANSA-Dpkg-2015-0860: Dpkg vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2015-12-03T00:00:00 | Engine | CSAF Perl Toolkit 0.25 |
| Current release date | 2015-12-03T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | Severity | ||
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.
Vulnerabilities
CVE-2015-0860
Vulnerability DescriptionOff-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.
| Weakness | CWE-189 : Numeric Errors |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Dpkg less than 1.18.4 |
|
Fixed
- Dpkg greater than or equal 1.18.4
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Dpkg-2015-0860 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2015/cpansa-dpkg-2015-0860.json - http://www.ubuntu.com/usn/USN-2820-1 external
http://www.ubuntu.com/usn/USN-2820-1 - http://www.debian.org/security/2015/dsa-3407 external
http://www.debian.org/security/2015/dsa-3407 - https://blog.fuzzing-project.org/30-Stack-overflows-and-out-of-bounds-read-in-dpkg-Debian.html external
https://blog.fuzzing-project.org/30-Stack-overflows-and-out-of-bounds-read-in-dpkg-Debian.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798324 external
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798324 - https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/dpkg-deb/extract.c?id=e65aa3db04eb908c9507d5d356a95cedb890814d external
https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/dpkg-deb/extract.c?id=e65aa3db04eb908c9507d5d356a95cedb890814d - https://security.gentoo.org/glsa/201612-07 external
https://security.gentoo.org/glsa/201612-07 - CVE-2015-0860 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2015-0860
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Thu Dec 3 00:00:00 2015 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/