PT-2015-4922 · Debian+3 · Dpkg+3

Hanno Böck · Published 2015-09-14 · Updated 2017-07-01 · CVE-2015-0860

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Debian dpkg versions 1.16.x through 1.16.16 Debian dpkg versions 1.17.x through 1.17.25

Description The issue is caused by an off-by-one error in the extracthalf function, which can lead to a stack-based buffer overflow. This can be triggered by the archive magic version number in an "old-style" Debian binary package.

Recommendations For Debian dpkg versions 1.16.x through 1.16.16, update to version 1.16.17 or later. For Debian dpkg versions 1.17.x through 1.17.25, update to version 1.17.26 or later.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2015-1779

CVE-2015-0860

DSA-3407-1

MGASA-2015-0482

SUSE-SU-2017:1096-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_1096-1

USN-2820-1

Affected Products

Alt Linux

Suse

Ubuntu

Dpkg

References · 33

• https://advisories.mageia.org/MGASA-2015-0482.html · Security Note
• http://ubuntu.com/usn/USN-2820-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0860 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-0860 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-0860 · Vendor Advisory
• http://debian.org/security/2015/dsa-3407 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1096-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0482 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-0860 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0860 · Security Note
• https://debian.org/security/2015/dsa-3407 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2820-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3407-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3407-1 · Vendor Advisory