PT-2010-1024 · Debian · Lintian

Raphael Geissert · Published 2010-02-02 · Updated 2010-02-03 · CVE-2009-4014

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lintian versions 1.23.x through 1.23.28 Lintian versions 1.24.x through 1.24.2.1 Lintian versions 2.x before 2.3.2

Description The issue involves multiple format string vulnerabilities that can be exploited remotely. These vulnerabilities are related to (1) check scripts and (2) the Lintian::Schedule module. The exploitation of these vulnerabilities may lead to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For Lintian versions 1.23.x through 1.23.28, update to a version after 1.23.28. For Lintian versions 1.24.x through 1.24.2.1, update to a version after 1.24.2.1. For Lintian versions 2.x before 2.3.2, update to version 2.3.2 or later.

Fix

Use of Externally-Controlled Format String

Path traversal

Weakness Enumeration

CWE-134

CWE-22

Related Identifiers

BDU:2015-02904

CVE-2009-4014

DSA-1979-1

Affected Products

Lintian

References · 18

• https://security-tracker.debian.org/tracker/CVE-2009-4014 · Vendor Advisory
• http://debian.org/security/2010/dsa-1979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4014 · Security Note
• http://ubuntu.com/usn/USN-891-1 · Vendor Advisory
• http://securityfocus.com/bid/37975 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4014 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-4014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02904 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4013 · Security Note
• https://osv.dev/vulnerability/CVE-2009-4014 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4015 · Security Note
• http://secunia.com/advisories/38375 · Vendor Advisory
• http://secunia.com/advisories/38379 · Vendor Advisory
• http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00 · Note
• http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d · Note