{"id":"CVE-2017-8283","details":"dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.","modified":"2026-03-14T09:24:06.260496Z","published":"2017-04-26T05:59:00.213Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/98064"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2017/04/20/2"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.3.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.3.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.20"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.21"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.22"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.23"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.23.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.23.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.24"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.25"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.26"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.26.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.27"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.28"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.29"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.30"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.0.31"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.4.1.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.12.99"}]},{"events":[{"introduced":"0"},{"last_affected":"1.6.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.7.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.7.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.7.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.8.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.8.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.8.1.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.8.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.8.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.8.3.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.20"}]},{"events":[{"introduced":"0"},{"last_affected":"1.9.21"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.18.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.20"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.21"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.22"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.23"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.24"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.25"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.26"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.27"}]},{"events":[{"introduced":"0"},{"last_affected":"1.10.28"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.11.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.20"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.21"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.22"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.23"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.24"}]},{"events":[{"introduced":"0"},{"last_affected":"1.13.25"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.16.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.16.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.16.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.16.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.16.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.16.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.20"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.21"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.22"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.23"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.24"}]},{"events":[{"introduced":"0"},{"last_affected":"1.14.25"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.3.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.4.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.5.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.5.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.5.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.5.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.5.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.5.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.6.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.7.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.7.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.15.8.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.0.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.0.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.0.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.1.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.1.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.4.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.4.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.4.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.16.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.20"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.21"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.22"}]},{"events":[{"introduced":"0"},{"last_affected":"1.17.23"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.0"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.1"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.2"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.3"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.4"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.5"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.6"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.7"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.8"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.9"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.10"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.11"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.12"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.13"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.14"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.15"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.16"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.17"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.18"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.19"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.20"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.21"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.22"}]},{"events":[{"introduced":"0"},{"last_affected":"1.18.23"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8283.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}