PT-2015-4062 · Debian+1 · Dpkg+1

Joshua Rogerson + 1 · Published 2015-01-20 · Updated 2017-09-08 · CVE-2014-8625

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dpkg versions prior to 1.17.22

Description The issue concerns multiple format string vulnerabilities in the parse error msg function. These vulnerabilities can be exploited by remote attackers to cause a denial of service, potentially leading to a crash, and may also allow the execution of arbitrary code. The exploitation can occur through format string specifiers in either the package or architecture name.

Recommendations For versions prior to 1.17.22, update to version 1.17.22 or later to resolve the issue.

Exploit

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

ALT-PU-2015-1131

CVE-2014-8625

Affected Products

Alt Linux

Dpkg

References · 19

• 🔥 http://seclists.org/oss-sec/2014/q4/539 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135 · Exploit
• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768485 · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-8625 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8625 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8625 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8625 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1131 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-8625 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-8625 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8625 · Security Note
• https://ubuntu.com/security/CVE-2014-8625 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98551 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2014-8625 · Note