CVE catalog

CVE-2014-3864

dpkg: CVE-2014-3864

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.83% · Oct 25, 2026

Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandpkgsid1.23.11fixed
Debiandpkgforky1.23.11fixed
Debiandpkgtrixie1.22.22fixed
Debiandpkgbookworm1.21.23fixed
Ubuntudpkg14.041.16.12ubuntu1vulnerable
Ubuntudpkg14.041.17.1ubuntu1vulnerable
Ubuntudpkg14.041.17.5ubuntu1vulnerable
Ubuntudpkg14.041.17.5ubuntu2vulnerable
Ubuntudpkg14.041.17.5ubuntu3vulnerable
Ubuntudpkg14.041.17.5ubuntu4vulnerable
Ubuntudpkg14.041.17.5ubuntu5vulnerable
Ubuntudpkg14.041.17.5ubuntu5.1vulnerable
Ubuntudpkg14.041.17.5ubuntu5.2vulnerable
Ubuntudpkg14.041.17.5ubuntu5.3fixed
Ubuntudpkg14.041.16.12ubuntu1vulnerable
Ubuntudpkg14.041.17.1ubuntu1vulnerable
Ubuntudpkg14.041.17.5ubuntu1vulnerable
Ubuntudpkg14.041.17.5ubuntu2vulnerable
Ubuntudpkg14.041.17.5ubuntu3vulnerable
Ubuntudpkg14.041.17.5ubuntu4vulnerable
Ubuntudpkg14.041.17.5ubuntu5vulnerable
Ubuntudpkg14.041.17.5ubuntu5.1vulnerable
Ubuntudpkg14.041.17.5ubuntu5.2vulnerable
Ubuntudpkg14.041.17.5ubuntu5.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandpkgsourcesid1.17.10not yet assignedNot reported[746498]
Debiandpkgsourceforky1.17.10not yet assignedNot reported[746498]
Debiandpkgsourcetrixie1.17.10not yet assignedNot reported[746498]
Debiandpkgsourcebookworm1.17.10not yet assignedNot reported[746498]
Ubuntudpkgdeb14.041.17.5ubuntu5.3Not reportedUBUNTU-CVE-2014-3864Not reported
Ubuntudpkgdeb14.041.17.5ubuntu5.3Not reportedUSN-2242-1Not reported

[Debian bug #746498]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dpkg]Fixed
    Details (2)

    • 1.21.23 · amd64 · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

    • 1.21.23 · arm64 · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

  • [dpkg-dev]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

  • [dselect]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.21.23 · amd64 · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

    • 1.21.23 · arm64 · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

  • [libdpkg-dev]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.21.23 · amd64 · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

    • 1.21.23 · arm64 · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

  • [libdpkg-perl]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

    • 1.21.23 · all · bookworm

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · bookworm; dsa · dpkg · debian · 12

[Debian 13 (Trixie)]

  • [dpkg]Fixed
    Details (2)

    • 1.22.22 · amd64 · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

    • 1.22.22 · arm64 · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

  • [dpkg-dev]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.22.22 · all · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

    • 1.22.22 · all · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

  • [dselect]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.22.22 · amd64 · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

    • 1.22.22 · arm64 · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

  • [libdpkg-dev]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.22.22 · amd64 · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

    • 1.22.22 · arm64 · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

  • [libdpkg-perl]Fixed

    Source package: [dpkg]

    Details (2)

    • 1.22.22 · all · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

    • 1.22.22 · all · trixie

      Fixed · Fixed: 1.17.10

      dsa · dpkg · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]