CVE-2015-0840 The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
MediumCVSS 4.3
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dpkg(Debian:12) | < 1.17.25 | 1.17.25 |
| debian/dpkg(Debian:13) | < 1.17.25 | 1.17.25 |
| debian/dpkg(Debian:14) | < 1.17.25 | 1.17.25 |
| debian/dpkg | <= 1.16.15 | No fix listed |
| debian/dpkg | = 1.17.0 | No fix listed |
| debian/dpkg | = 1.17.1 | No fix listed |
| debian/dpkg | = 1.17.2 | No fix listed |
| debian/dpkg | = 1.17.3 | No fix listed |
| debian/dpkg | = 1.17.4 | No fix listed |
| debian/dpkg | = 1.17.5 | No fix listed |
| debian/dpkg | = 1.17.6 | No fix listed |
| debian/dpkg | = 1.17.7 | No fix listed |
| debian/dpkg | = 1.17.8 | No fix listed |
| debian/dpkg | = 1.17.9 | No fix listed |
| debian/dpkg | = 1.17.10 | No fix listed |
| debian/dpkg | = 1.17.11 | No fix listed |
| debian/dpkg | = 1.17.12 | No fix listed |
| debian/dpkg | = 1.17.13 | No fix listed |
| debian/dpkg | = 1.17.14 | No fix listed |
| debian/dpkg | = 1.17.15 | No fix listed |
| debian/dpkg | = 1.17.16 | No fix listed |
| debian/dpkg | = 1.17.17 | No fix listed |
| debian/dpkg | = 1.17.18 | No fix listed |
| debian/dpkg | = 1.17.19 | No fix listed |
| debian/dpkg | = 1.17.20 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dpkg | = 1.17.21 | No fix listed |
| debian/dpkg | = 1.17.22 | No fix listed |
| debian/dpkg | = 1.17.23 | No fix listed |
| debian/dpkg | = 1.17.24 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
References
- Debian Security Tracker CVE-2015-0840 vendor-advisory
- FEDORA-2015-6974 vendor-advisory
- openSUSE-SU-2015:1058 vendor-advisory
- DSA-3217 vendor-advisory
- USN-2566-1 patch vendor-advisory