Read the docs
TI-2014-02585 Aliases CVE-2014-3227GHSA-xjq6-63hc-vrrj

dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to…

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.

Why it matters now

EPSS 0.01821 78th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:debian:dpkg:1.15.9:*:*:*:*:*:*:*1.15.9VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.0:*:*:*:*:*:*:*1.16.0VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.0.1:*:*:*:*:*:*:*1.16.0.1VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.0.2:*:*:*:*:*:*:*1.16.0.2VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.0.3:*:*:*:*:*:*:*1.16.0.3VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.1:*:*:*:*:*:*:*1.16.1VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.1.1:*:*:*:*:*:*:*1.16.1.1VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.1.2:*:*:*:*:*:*:*1.16.1.2VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.2:*:*:*:*:*:*:*1.16.2VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.3:*:*:*:*:*:*:*1.16.3VulnerableDebian
  • cpe:2.3:a:debian:dpkg:1.15.9:*:*:*:*:*:*:* Versions 1.15.9 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.0:*:*:*:*:*:*:* Versions 1.16.0 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.0.1:*:*:*:*:*:*:* Versions 1.16.0.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.0.2:*:*:*:*:*:*:* Versions 1.16.0.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.0.3:*:*:*:*:*:*:* Versions 1.16.0.3 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.1:*:*:*:*:*:*:* Versions 1.16.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.1.1:*:*:*:*:*:*:* Versions 1.16.1.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.1.2:*:*:*:*:*:*:* Versions 1.16.1.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.2:*:*:*:*:*:*:* Versions 1.16.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.3:*:*:*:*:*:*:* Versions 1.16.3 Vulnerable ·Debian
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:debian:dpkg:1.16.4:*:*:*:*:*:*:*1.16.4VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.4.1:*:*:*:*:*:*:*1.16.4.1VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.4.2:*:*:*:*:*:*:*1.16.4.2VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.4.3:*:*:*:*:*:*:*1.16.4.3VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.5:*:*:*:*:*:*:*1.16.5VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.6:*:*:*:*:*:*:*1.16.6VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.7:*:*:*:*:*:*:*1.16.7VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.8:*:*:*:*:*:*:*1.16.8VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.9:*:*:*:*:*:*:*1.16.9VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.10:*:*:*:*:*:*:*1.16.10VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.11:*:*:*:*:*:*:*1.16.11VulnerableDebian
cpe:2.3:a:debian:dpkg:1.16.12:*:*:*:*:*:*:*1.16.12VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.0:*:*:*:*:*:*:*1.17.0VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.1:*:*:*:*:*:*:*1.17.1VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.2:*:*:*:*:*:*:*1.17.2VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.3:*:*:*:*:*:*:*1.17.3VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.4:*:*:*:*:*:*:*1.17.4VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.5:*:*:*:*:*:*:*1.17.5VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.6:*:*:*:*:*:*:*1.17.6VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.7:*:*:*:*:*:*:*1.17.7VulnerableDebian
cpe:2.3:a:debian:dpkg:1.17.8:*:*:*:*:*:*:*1.17.8VulnerableDebian
  • cpe:2.3:a:debian:dpkg:1.16.4:*:*:*:*:*:*:* Versions 1.16.4 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.4.1:*:*:*:*:*:*:* Versions 1.16.4.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.4.2:*:*:*:*:*:*:* Versions 1.16.4.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.4.3:*:*:*:*:*:*:* Versions 1.16.4.3 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.5:*:*:*:*:*:*:* Versions 1.16.5 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.6:*:*:*:*:*:*:* Versions 1.16.6 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.7:*:*:*:*:*:*:* Versions 1.16.7 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.8:*:*:*:*:*:*:* Versions 1.16.8 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.9:*:*:*:*:*:*:* Versions 1.16.9 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.10:*:*:*:*:*:*:* Versions 1.16.10 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.11:*:*:*:*:*:*:* Versions 1.16.11 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.16.12:*:*:*:*:*:*:* Versions 1.16.12 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.0:*:*:*:*:*:*:* Versions 1.17.0 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.1:*:*:*:*:*:*:* Versions 1.17.1 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.2:*:*:*:*:*:*:* Versions 1.17.2 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.3:*:*:*:*:*:*:* Versions 1.17.3 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.4:*:*:*:*:*:*:* Versions 1.17.4 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.5:*:*:*:*:*:*:* Versions 1.17.5 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.6:*:*:*:*:*:*:* Versions 1.17.6 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.7:*:*:*:*:*:*:* Versions 1.17.7 Vulnerable ·Debian
  • cpe:2.3:a:debian:dpkg:1.17.8:*:*:*:*:*:*:* Versions 1.17.8 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3227
  2. 2026-10-03 Alias added: GHSA-xjq6-63hc-vrrj

References

Other 3

  • TI-2017-05855 dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does… CVSS 3.0CRITICAL 9.8
  • TI-2022-01534 directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar CVSS 3.1CRITICAL 9.8
  • TI-2025-05698 dpkg-deb: Fix cleanup for control member with restricted directories CVSS 3.1HIGH 8.2
  • TI-2015-00801 Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb… CVSS 2.0HIGH 7.5
  • TI-2026-01867 Infinite loop in Debian dpkg CVSS 3.1HIGH 7.5
  • TI-2014-07084 Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in… CVSS 2.0MEDIUM 6.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences