What’s Vulnerable › Vulnerabilities

CVE-2014-3865

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-05-30 · updated 2026-06-17
• Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++ header line with a blank pathname.

Affected products

• Debian Dpkg-Dev: 1.3.0

References

• http://openwall.com/lists/oss-security/2014/05/25/2
• http://www.debian.org/security/2014/dsa-2953
• http://www.securityfocus.com/bid/67727
• http://www.ubuntu.com/usn/USN-2242-1
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749183
• http://openwall.com/lists/oss-security/2014/05/25/2
• http://www.debian.org/security/2014/dsa-2953
• http://www.securityfocus.com/bid/67727
• http://www.ubuntu.com/usn/USN-2242-1
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749183

Get alerted when CVE-2014-3865 or the next vulnerability affects your stack