Read the docs
TI-2009-03806 Aliases CVE-2009-4014GHSA-w9gf-w4gv-5j2q

Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through…

Priority LOW 38CWE-134Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-134 and the CVSS impact.

Summary

Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.

Why it matters now

EPSS 0.03059 87th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 61

CPEVersionsRoleVendor
cpe:2.3:a:debian:lintian:1.23.0:*:*:*:*:*:*:*1.23.0VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.1:*:*:*:*:*:*:*1.23.1VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.2:*:*:*:*:*:*:*1.23.2VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.3:*:*:*:*:*:*:*1.23.3VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.4:*:*:*:*:*:*:*1.23.4VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.5:*:*:*:*:*:*:*1.23.5VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.6:*:*:*:*:*:*:*1.23.6VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.7:*:*:*:*:*:*:*1.23.7VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.8:*:*:*:*:*:*:*1.23.8VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.9:*:*:*:*:*:*:*1.23.9VulnerableDebian
  • cpe:2.3:a:debian:lintian:1.23.0:*:*:*:*:*:*:* Versions 1.23.0 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.1:*:*:*:*:*:*:* Versions 1.23.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.2:*:*:*:*:*:*:* Versions 1.23.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.3:*:*:*:*:*:*:* Versions 1.23.3 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.4:*:*:*:*:*:*:* Versions 1.23.4 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.5:*:*:*:*:*:*:* Versions 1.23.5 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.6:*:*:*:*:*:*:* Versions 1.23.6 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.7:*:*:*:*:*:*:* Versions 1.23.7 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.8:*:*:*:*:*:*:* Versions 1.23.8 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.9:*:*:*:*:*:*:* Versions 1.23.9 Vulnerable ·Debian
Show 51 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:debian:lintian:1.23.10:*:*:*:*:*:*:*1.23.10VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.11:*:*:*:*:*:*:*1.23.11VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.12:*:*:*:*:*:*:*1.23.12VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.13:*:*:*:*:*:*:*1.23.13VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.14:*:*:*:*:*:*:*1.23.14VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.15:*:*:*:*:*:*:*1.23.15VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.16:*:*:*:*:*:*:*1.23.16VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.17:*:*:*:*:*:*:*1.23.17VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.18:*:*:*:*:*:*:*1.23.18VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.19:*:*:*:*:*:*:*1.23.19VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.20:*:*:*:*:*:*:*1.23.20VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.22:*:*:*:*:*:*:*1.23.22VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.23:*:*:*:*:*:*:*1.23.23VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.24:*:*:*:*:*:*:*1.23.24VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.25:*:*:*:*:*:*:*1.23.25VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.26:*:*:*:*:*:*:*1.23.26VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.27:*:*:*:*:*:*:*1.23.27VulnerableDebian
cpe:2.3:a:debian:lintian:1.23.28:*:*:*:*:*:*:*1.23.28VulnerableDebian
cpe:2.3:a:debian:lintian:1.24.0:*:*:*:*:*:*:*1.24.0VulnerableDebian
cpe:2.3:a:debian:lintian:1.24.1:*:*:*:*:*:*:*1.24.1VulnerableDebian
cpe:2.3:a:debian:lintian:1.24.2:*:*:*:*:*:*:*1.24.2VulnerableDebian
cpe:2.3:a:debian:lintian:1.24.2.1:*:*:*:*:*:*:*1.24.2.1VulnerableDebian
cpe:2.3:a:debian:lintian:2.0-rc1:*:*:*:*:*:*:*2.0-rc1VulnerableDebian
cpe:2.3:a:debian:lintian:2.0-rc2:*:*:*:*:*:*:*2.0-rc2VulnerableDebian
cpe:2.3:a:debian:lintian:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableDebian
cpe:2.3:a:debian:lintian:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableDebian
cpe:2.3:a:debian:lintian:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableDebian
cpe:2.3:a:debian:lintian:2.1.3:*:*:*:*:*:*:*2.1.3VulnerableDebian
cpe:2.3:a:debian:lintian:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableDebian
cpe:2.3:a:debian:lintian:2.1.5:*:*:*:*:*:*:*2.1.5VulnerableDebian
cpe:2.3:a:debian:lintian:2.1.6:*:*:*:*:*:*:*2.1.6VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.4:*:*:*:*:*:*:*2.2.4VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.7:*:*:*:*:*:*:*2.2.7VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.10:*:*:*:*:*:*:*2.2.10VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.11:*:*:*:*:*:*:*2.2.11VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.12:*:*:*:*:*:*:*2.2.12VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.13:*:*:*:*:*:*:*2.2.13VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.14:*:*:*:*:*:*:*2.2.14VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.15:*:*:*:*:*:*:*2.2.15VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.16:*:*:*:*:*:*:*2.2.16VulnerableDebian
cpe:2.3:a:debian:lintian:2.2.18:*:*:*:*:*:*:*2.2.18VulnerableDebian
cpe:2.3:a:debian:lintian:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableDebian
cpe:2.3:a:debian:lintian:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableDebian
  • cpe:2.3:a:debian:lintian:1.23.10:*:*:*:*:*:*:* Versions 1.23.10 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.11:*:*:*:*:*:*:* Versions 1.23.11 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.12:*:*:*:*:*:*:* Versions 1.23.12 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.13:*:*:*:*:*:*:* Versions 1.23.13 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.14:*:*:*:*:*:*:* Versions 1.23.14 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.15:*:*:*:*:*:*:* Versions 1.23.15 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.16:*:*:*:*:*:*:* Versions 1.23.16 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.17:*:*:*:*:*:*:* Versions 1.23.17 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.18:*:*:*:*:*:*:* Versions 1.23.18 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.19:*:*:*:*:*:*:* Versions 1.23.19 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.20:*:*:*:*:*:*:* Versions 1.23.20 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.22:*:*:*:*:*:*:* Versions 1.23.22 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.23:*:*:*:*:*:*:* Versions 1.23.23 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.24:*:*:*:*:*:*:* Versions 1.23.24 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.25:*:*:*:*:*:*:* Versions 1.23.25 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.26:*:*:*:*:*:*:* Versions 1.23.26 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.27:*:*:*:*:*:*:* Versions 1.23.27 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.23.28:*:*:*:*:*:*:* Versions 1.23.28 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.24.0:*:*:*:*:*:*:* Versions 1.24.0 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.24.1:*:*:*:*:*:*:* Versions 1.24.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.24.2:*:*:*:*:*:*:* Versions 1.24.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:1.24.2.1:*:*:*:*:*:*:* Versions 1.24.2.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.0-rc1:*:*:*:*:*:*:* Versions 2.0-rc1 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.0-rc2:*:*:*:*:*:*:* Versions 2.0-rc2 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.12:*:*:*:*:*:*:* Versions 2.2.12 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.13:*:*:*:*:*:*:* Versions 2.2.13 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.14:*:*:*:*:*:*:* Versions 2.2.14 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.15:*:*:*:*:*:*:* Versions 2.2.15 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.16:*:*:*:*:*:*:* Versions 2.2.16 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.2.18:*:*:*:*:*:*:* Versions 2.2.18 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Debian
  • cpe:2.3:a:debian:lintian:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-4014
  2. 2026-10-03 Alias added: GHSA-w9gf-w4gv-5j2q

References

Advisory 2

Other 4

  • TI-2009-03805 Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x… CVSS 3.1CRITICAL 9.8
  • TI-2009-03807 Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows… CVSS 2.0HIGH 7.5
  • TI-2017-06337 Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger… CVSS 3.0HIGH 7.8
  • TI-2013-01248 Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks. CVSS 3.1MEDIUM 6.3
  • TI-2004-00906 lintian 1.23 and earlier removes the working directory even if it was not created by… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences