Ubuntu 15.10: USN-2820-2 Low: Dpkg Remote Code Execution Vulnerability

ubuntu

November 26, 2015

dpkg-deb could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

dpkg-deb could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- dpkg: Debian package management system

Details:

Hanno Boeck discovered that the dpkg-deb tool incorrectly handled certain

old style Debian binary packages. If a user or an automated system were

tricked into unpacking a specially crafted binary package, a remote

attacker could possibly use this issue to execute arbitrary code.

Topics Covered

security advisory moderate software update remote code execution Ubuntu attack vector dpkg

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  dpkg                            1.18.2ubuntu5.1

Ubuntu 15.04:
  dpkg                            1.17.25ubuntu1.1

Ubuntu 14.04 LTS:
  dpkg                            1.17.5ubuntu5.5

Ubuntu 12.04 LTS:
  dpkg                            1.16.1.2ubuntu7.7

In general, a standard system update will make all the necessary changes.