A vulnerability has been discovered in dpkg, which allows for directory traversal.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/dpkg | * | < 1.20.9-r1 | >= 1.20.9-r1 |
Debian package management system.
Please review the CVE indentifier referenced below for details.
Dpkg::Source::Archive in dpkg, the Debian package management system, is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
There is no known workaround at this time.
All dpkg users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/dpkg-1.20.9-r1"
A vulnerability was discovered in dpkg which could potentially lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/dpkg | * | < 1.17.26 | >= 1.17.26 |
Debian package management system.
Gentoo Linux developer, Hanno Böck, discovered an off-by-one error in the dpkg-deb component of dpkg, the Debian package management system, which triggers a stack-based buffer overflow.
An attacker could potentially execute arbitrary code if an user or an automated system were tricked into processing a specially crafted Debian binary package (.deb).
There is no known workaround at this time.
All dpkg users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/dpkg-1.17.26"