DP
Product
Dpkg
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 2Medium 0Low 0
Watch
Add Dpkg to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-1664 | 9.8 | May 26 | Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability Affected: 1.14.17 before 1.18.26; 1.19.0 before 1.19.8; 1.20.0 before 1.20.10; 1.21.0 before 1.21.8 |
| CVE-2017-8283 | 9.8 | Apr 26 | dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote… Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +34 more |
| CVE-2025-6297 | 8.2 | Jul 1 | It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe… Affected: before 1.22.21 |
| CVE-2026-2219 | 7.5 | Mar 7 | It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a… Affected: 1.21.18 before 1.21.23; 1.22.0 before 1.22.22; 1.23.0 before 1.23.6 |
| CVE-2015-0860 | – | Dec 3 | Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers… Affected: 1.16.0; 1.16.0.1; 1.16.0.2; 1.16.0.3; 1.16.1; 1.16.1.1; +34 more |
| CVE-2015-0840 | – | Apr 13 | The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file… Affected: through 1.16.15; 1.17.0; 1.17.1; 1.17.2; 1.17.3; 1.17.4; +20 more |
| CVE-2014-8625 | – | Jan 20 | Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and… Affected: through 1.17.21 |
| CVE-2014-3227 | – | May 30 | dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in… Affected: 1.15.9; 1.16.0; 1.16.0.1; 1.16.0.2; 1.16.0.3; 1.16.1; +25 more |
| CVE-2014-3127 | – | May 14 | dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers… Affected: 1.16.0; 1.16.0.1; 1.16.0.2; 1.16.0.3; 1.16.1; 1.16.1.1; +34 more |
| CVE-2014-0471 | – | Apr 30 | Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary… Affected: through 1.15.8.8; 1.9.1; 1.9.2; 1.9.3; 1.9.7; 1.9.8; +34 more |
| CVE-2011-0402 | – | Jan 11 | dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via a symlink attack on unspecified files in the .pc directory Affected: through 1.14.30; 1.9.19; 1.9.20; 1.9.21; 1.10; 1.10.1; +34 more |
| CVE-2010-1679 | – | Jan 11 | Directory traversal vulnerability in dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via directory traversal… Affected: through 1.14.30; 1.9.19; 1.9.20; 1.9.21; 1.10; 1.10.1; +34 more |
| CVE-2004-2768 | – | Jun 8 | dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard… Affected: 1.9.21 |
| CVE-2010-0396 | – | Mar 15 | Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify arbitrary files via a crafted Debian source archive Affected: through 1.14.28; 1.9.19; 1.9.20; 1.9.21; 1.10; 1.10.1; +34 more |
Showing 14