CVE-2014-1833 Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
MediumCVSS 5.0
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/devscripts(Debian:12) | < 2.14.8 | 2.14.8 |
| debian/devscripts(Debian:13) | < 2.14.8 | 2.14.8 |
| debian/devscripts(Debian:14) | < 2.14.8 | 2.14.8 |
| devscripts devel team devscripts | = 2.14.1 | No fix listed |
References
- Debian Security Tracker CVE-2014-1833 vendor-advisory
- bugs.debian.org
- 102748 vdb-entry
- [oss-security] 20140131 Re: CVE request: uupdate (devscripts) directory traversal mailing-list
- [oss-security] 20140131 CVE request: uupdate (devscripts) directory traversal mailing-list
- 65260 vdb-entry
- USN-2649-1 vendor-advisory
- bugzilla.redhat.com vendor-advisory
- devscripts-cve20141833-dir-trav(90842) vdb-entry
- bugs.debian.org issue-tracking