Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++ header line with a blank pathname.
Múltiples vulnerabilidades de salto de directorio en dpkg-source en dpkg-dev 1.3.0 permiten a atacantes remotos modificar archivos fuera de los directorios intencionados a través de un paquete fuente con una pseudo-cabecera Index: manipulada en conjunto con (1) líneas de cabecera missing --- and +++ o (2) una línea de cabecera +++ con un nombre de ruta en blanco.
It was discovered that dpkg incorrectly handled certain patches when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or potentially gaining access to the system.
