GCVE - cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Debian (`4199fb5b-36f6-5ceb-83d5-855460345e36`)
Product	Dpkg (`70d9845d-a063-5593-86fb-6bada4efd00c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/dpkg`	purl2cpe	2026-06-01 10:17:13.829544
`pkg:deb/ubuntu/dpkg`	purl2cpe	2026-06-01 10:17:13.829546
`pkg:github/davidben/dpkg`	purl2cpe	2026-06-01 10:17:13.829547
`pkg:github/guillemj/dpkg`	purl2cpe	2026-06-01 10:17:13.829548
`pkg:rpm/fedora/dpkg`	purl2cpe	2026-06-01 10:17:13.829550
`pkg:rpm/opensuse/dpkg`	purl2cpe	2026-06-01 10:17:13.829551

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-2219`	vulnerable	2026-06-08 07:55:16.740057	Details available It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU). Published: 2026-03-07T08:10:53.207Z Updated: 2026-03-09T14:52:18.435Z Open on db.gcve.eu Reference links https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=6610297a62c0780dd0e80b0e302ef64fdcc9d313 https://bugs.debian.org/1129722	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-6297`	vulnerable	2026-06-08 07:43:14.779085	dpkg-deb: Fix cleanup for control member with restricted directories It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions. Published: 2025-07-01T16:16:54.624Z Updated: 2026-07-08T07:48:03.368Z Open on db.gcve.eu Reference links https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=ed6bbd445dd8800308c67236ba35d08004c98e82	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-1664`	vulnerable	2026-06-08 05:39:13.660891	directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs. Published: 2022-05-26T08:20:15.198Z Updated: 2024-09-17T02:16:10.760Z Open on db.gcve.eu Reference links https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5 https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495 https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be https://lists.debian.org/debian-security-announce/2022/msg00115.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0840`	vulnerable	2026-06-08 05:06:24.010928	Details available The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc). Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T04:26:10.605Z Open on db.gcve.eu Reference links http://www.ubuntu.com/usn/USN-2566-1 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html http://lists.opensuse.org/opensuse-updates/2015-06/msg00029.html http://www.debian.org/security/2015/dsa-3217	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8625`	vulnerable	2026-06-08 05:06:09.747054	Details available Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name. Published: 2015-01-20T15:00:00.000Z Updated: 2024-08-06T13:26:02.476Z Open on db.gcve.eu Reference links http://seclists.org/oss-sec/2014/q4/551 https://exchange.xforce.ibmcloud.com/vulnerabilities/98551 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768485 http://seclists.org/oss-sec/2014/q4/539	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0471`	vulnerable	2026-06-08 05:05:12.933268	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0402`	vulnerable	2026-06-08 04:56:36.819597	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1679`	vulnerable	2026-06-08 04:54:09.903958	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-0396`	vulnerable	2026-06-08 04:52:02.142089	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.