Ubuntu 22.04 LTS USN-5446-1 Critical Dpkg Malicious Package Threat

ubuntu

May 26, 2022

A malicious source package could write files outside the unpack directory.

Summary

A malicious source package could write files outside the unpack directory.

Software Description:

- dpkg: Debian package management system

Details:

Max Justicz discovered that dpkg incorrectly handled unpacking certain

source packages. If a user or an automated system were tricked into

unpacking a specially crafted source package, a remote attacker could

modify files outside the target unpack directory, leading to a denial of

service or potentially gaining access to the system.

Topics Covered

security advisory denial of service critical Ubuntu dpkg malicious package

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  dpkg                            1.21.1ubuntu2.1
  libdpkg-perl                    1.21.1ubuntu2.1

Ubuntu 21.10:
  dpkg                            1.20.9ubuntu2.2
  libdpkg-perl                    1.20.9ubuntu2.2

Ubuntu 20.04 LTS:
  dpkg                            1.19.7ubuntu3.2
  libdpkg-perl                    1.19.7ubuntu3.2

Ubuntu 18.04 LTS:
  dpkg                            1.19.0.5ubuntu2.4
  libdpkg-perl                    1.19.0.5ubuntu2.4

In general, a standard system update will make all the necessary changes.