oss-sec mailing list archives
CVE request: another path traversal in dpkg-source during unpack
From: Raphael Geissert <geissert () debian org>
Date: Sun, 25 May 2014 11:31:51 +0200
Hi, Another path traversal was discovered[1] in dpkg-source, related to the unpacking of source packages with specially-crafted patches. While waiting for the original reporter's PoC/more information, Guillem Jover (dpkg maintainer) independently re-discovered the issue, and a second one. This second issue has now been publicly reported as [2] to ease the assignment of CVE id(s) given the combination of private and not-very- specific public information. Both issues are independent of the version of the patch tool. While figuring out whether one or two ids should be requested (at least from our POV), it appears that we can say that [2] is a superset of [1] - this is based on the minimal fixes needed to fix either vulnerability: the fix for [1] does not fix [2], but the fix for [2] does fix [1]. Could a CVE id be assigned please? CC'ing Guillem for any complimentary information. Thanks in advance. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746498 [2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749183 Cheers, -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net
Current thread:
- CVE request: another path traversal in dpkg-source during unpack Raphael Geissert (May 25)
- Re: CVE request: another path traversal in dpkg-source during unpack cve-assign (May 29)