CVE-2014-0471: Path Traversal
Published Apr 28, 2014
·Updated
Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."
Affected Software
175 affected componentsFixes available
Debian Dpkg<=1.15.8.8
Debian Dpkg=1.9.1
Debian Dpkg=1.9.2
Debian Dpkg=1.9.3
Debian Dpkg=1.9.7
Debian Dpkg=1.9.8
Debian Dpkg=1.9.9
Debian Dpkg=1.9.10
Debian Dpkg=1.9.11
Debian Dpkg=1.9.12
Debian Dpkg=1.9.13
Debian Dpkg=1.9.14
Debian Dpkg=1.9.15
Debian Dpkg=1.9.16
Debian Dpkg=1.9.17
Debian Dpkg=1.9.18
Debian Dpkg=1.9.19
Debian Dpkg=1.9.20
Debian Dpkg=1.9.21
Debian Dpkg=1.10
Debian Dpkg=1.10.1
Debian Dpkg=1.10.2
Debian Dpkg=1.10.3
Debian Dpkg=1.10.4
Debian Dpkg=1.10.5
Debian Dpkg=1.10.6
Debian Dpkg=1.10.7
Debian Dpkg=1.10.8
Debian Dpkg=1.10.9
Debian Dpkg=1.10.11
Debian Dpkg=1.10.12
Debian Dpkg=1.10.13
Debian Dpkg=1.10.14
Debian Dpkg=1.10.15
Debian Dpkg=1.10.16
Debian Dpkg=1.10.17
Debian Dpkg=1.10.18
Debian Dpkg=1.10.18.1
Debian Dpkg=1.10.19
Debian Dpkg=1.10.20
Debian Dpkg=1.10.21
Debian Dpkg=1.10.22
Debian Dpkg=1.10.23
Debian Dpkg=1.10.24
Debian Dpkg=1.10.25
Debian Dpkg=1.10.26
Debian Dpkg=1.10.27
Debian Dpkg=1.10.28
Debian Dpkg=1.13.0
Debian Dpkg=1.13.1
Debian Dpkg=1.13.2
Debian Dpkg=1.13.3
Debian Dpkg=1.13.4
Debian Dpkg=1.13.5
Debian Dpkg=1.13.6
Debian Dpkg=1.13.7
Debian Dpkg=1.13.8
Debian Dpkg=1.13.9
Debian Dpkg=1.13.10
Debian Dpkg=1.13.11
Debian Dpkg=1.13.11.1
Debian Dpkg=1.13.12
Debian Dpkg=1.13.13
Debian Dpkg=1.13.14
Debian Dpkg=1.13.15
Debian Dpkg=1.13.16
Debian Dpkg=1.13.17
Debian Dpkg=1.13.18
Debian Dpkg=1.13.19
Debian Dpkg=1.13.20
Debian Dpkg=1.13.21
Debian Dpkg=1.13.22
Debian Dpkg=1.13.23
Debian Dpkg=1.13.24
Debian Dpkg=1.13.25
Debian Dpkg=1.14.0
Debian Dpkg=1.14.1
Debian Dpkg=1.14.2
Debian Dpkg=1.14.3
Debian Dpkg=1.14.4
Debian Dpkg=1.14.5
Debian Dpkg=1.14.6
Debian Dpkg=1.14.7
Debian Dpkg=1.14.8
Debian Dpkg=1.14.9
Debian Dpkg=1.14.10
Debian Dpkg=1.14.11
Debian Dpkg=1.14.12
Debian Dpkg=1.14.13
Debian Dpkg=1.14.14
Debian Dpkg=1.14.15
Debian Dpkg=1.14.16
Debian Dpkg=1.14.16.1
Debian Dpkg=1.14.16.2
Debian Dpkg=1.14.16.3
Debian Dpkg=1.14.16.4
Debian Dpkg=1.14.16.5
Debian Dpkg=1.14.16.6
Debian Dpkg=1.14.17
Debian Dpkg=1.14.18
Debian Dpkg=1.14.19
Debian Dpkg=1.14.20
Debian Dpkg=1.14.21
Debian Dpkg=1.14.22
Debian Dpkg=1.14.23
Debian Dpkg=1.14.24
Debian Dpkg=1.14.25
Debian Dpkg=1.14.26
Debian Dpkg=1.14.27
Debian Dpkg=1.14.28
Debian Dpkg=1.14.29
Debian Dpkg=1.14.30
Debian Dpkg=1.15.0
Debian Dpkg=1.15.1
Debian Dpkg=1.15.2
Debian Dpkg=1.15.3
Debian Dpkg=1.15.3.1
Debian Dpkg=1.15.4
Debian Dpkg=1.15.4.1
Debian Dpkg=1.15.5
Debian Dpkg=1.15.5.1
Debian Dpkg=1.15.5.2
Debian Dpkg=1.15.5.3
Debian Dpkg=1.15.5.4
Debian Dpkg=1.15.5.5
Debian Dpkg=1.15.5.6
Debian Dpkg=1.15.6
Debian Dpkg=1.15.6.1
Debian Dpkg=1.15.7
Debian Dpkg=1.15.7.1
Debian Dpkg=1.15.7.2
Debian Dpkg=1.15.8
Debian Dpkg=1.15.8.1
Debian Dpkg=1.15.8.2
Debian Dpkg=1.15.8.3
Debian Dpkg=1.15.8.4
Debian Dpkg=1.15.8.5
Debian Dpkg=1.15.8.6
Debian Dpkg=1.15.8.7
Debian Dpkg=1.15.8.9
Debian Dpkg=1.16.0
Debian Dpkg=1.16.0.1
Debian Dpkg=1.16.0.2
Debian Dpkg=1.16.0.3
Debian Dpkg=1.16.1
Debian Dpkg=1.16.1.1
Debian Dpkg=1.16.1.2
Debian Dpkg=1.16.2
Debian Dpkg=1.16.3
Debian Dpkg=1.16.4
Debian Dpkg=1.16.4.1
Debian Dpkg=1.16.4.2
Debian Dpkg=1.16.4.3
Debian Dpkg=1.16.5
Debian Dpkg=1.16.6
Debian Dpkg=1.16.7
Debian Dpkg=1.16.8
Debian Dpkg=1.16.9
Debian Dpkg=1.16.10
Debian Dpkg=1.16.11
Debian Dpkg=1.16.12
Debian Dpkg=1.17.0
Debian Dpkg=1.17.1
Debian Dpkg=1.17.2
Debian Dpkg=1.17.3
Debian Dpkg=1.17.4
Debian Dpkg=1.17.5
Debian Dpkg=1.17.6
Debian Dpkg=1.17.7
Canonical Ubuntu Linux=10.04
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=12.10
Canonical Ubuntu Linux=13.10
Canonical Ubuntu Linux=14.04
debian/dpkg
1.20.131.20.101.21.221.22.18
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dpkgto a version that resolves this vulnerability.Fixed in 1.20.13Fixed in 1.20.10Fixed in 1.21.22Fixed in 1.22.18
Event History
Apr 28, 2014
Data Sourced
via Debian·08:39 PM
SeverityAffected Software
Apr 30, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:22 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0471?
CVE-2014-0471 is considered a medium severity vulnerability due to its potential to allow remote attackers to write arbitrary files.
2
How do I fix CVE-2014-0471?
To fix CVE-2014-0471, upgrade dpkg to version 1.15.9 or later.
3
What systems are affected by CVE-2014-0471?
CVE-2014-0471 affects dpkg versions prior to 1.15.9, including some versions in Debian and Ubuntu.
4
What type of vulnerability is CVE-2014-0471?
CVE-2014-0471 is a directory traversal vulnerability that affects the unpacking functionality of dpkg.
5
Can CVE-2014-0471 be exploited remotely?
Yes, CVE-2014-0471 can be exploited remotely through crafted source packages.