Debian dpkg 1.17.24

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:debian:dpkg:1.17.24:*:*:*:*:*:*:*

part: a version: 1.17.24 update: *

VendorDebian (4199fb5b-36f6-5ceb-83d5-855460345e36)
ProductDpkg (70d9845d-a063-5593-86fb-6bada4efd00c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/dpkg purl2cpe 2026-06-01 10:17:13.902096
pkg:deb/ubuntu/dpkg purl2cpe 2026-06-01 10:17:13.902097
pkg:github/davidben/dpkg purl2cpe 2026-06-01 10:17:13.902099
pkg:github/guillemj/dpkg purl2cpe 2026-06-01 10:17:13.902100
pkg:rpm/fedora/dpkg purl2cpe 2026-06-01 10:17:13.902101
pkg:rpm/opensuse/dpkg purl2cpe 2026-06-01 10:17:13.902103

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2015-0860 vulnerable 2026-06-08 05:06:24.104930 Details available
Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.
Published: 2015-12-03T20:00:00.000Z
Updated: 2024-08-06T04:26:11.051Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-0840 vulnerable 2026-06-08 05:06:24.024010 Details available
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
Published: 2015-04-13T14:00:00.000Z
Updated: 2024-08-06T04:26:10.605Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.