PT-2011-2323 · Debian · Dpkg

Published 2011-01-11 · Updated 2017-08-17 · CVE-2011-0402

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dpkg versions prior to 1.14.31 dpkg version 1.15.x

Description The issue allows user-assisted remote attackers to modify arbitrary files via a symlink attack on unspecified files in the .pc directory.

Recommendations For dpkg versions prior to 1.14.31, update to version 1.14.31 or later. For dpkg version 1.15.x, consider restricting access to the .pc directory until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2011-0402

DSA-2142-1

Affected Products

Dpkg

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2011-0402 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053306.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2142 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0402 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0044 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053311.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0402 · Vendor Advisory
• http://secunia.com/advisories/42826 · Vendor Advisory
• http://ubuntu.com/usn/USN-1038-1 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0040 · Vendor Advisory
• http://secunia.com/advisories/42831 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-0402 · Vendor Advisory
• http://secunia.com/advisories/43054 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64614 · Note
• http://vupen.com/english/advisories/2011/0196 · Note