Multiple directory traversal flaws were found in dpkg-source. When unpacking a source package, this could lead to the creation of files outside of the directory you are unpacking in. CVE-2014-3864: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746498 CVE-2014-3865: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749183 References: http://seclists.org/oss-sec/2014/q2/388 I am not sure where the patches are located.
Created dpkg tracking bugs for this issue: Affects: fedora-all [bug 1103027] Affects: epel-all [bug 1103028]
I still waiting for Debian release : http://packages.qa.debian.org/d/dpkg.html seems finally they fix it : http://anonscm.debian.org/gitweb/?p=dpkg/dpkg.git;a=shortlog;h=refs/heads/wheezy after that I will try build on epel
(In reply to Sergio Monteiro Basto from comment #2) > I still waiting for Debian release : > > http://packages.qa.debian.org/d/dpkg.html > > seems finally they fix it : > http://anonscm.debian.org/gitweb/?p=dpkg/dpkg.git;a=shortlog;h=refs/heads/ > wheezy > > > after that I will try build on epel That is fine, thank you for the progress update!
dpkg-1.16.15-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
dpkg-1.16.16-5.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
dpkg-1.16.16-5.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
I couldn't build dpkg for el5 because DEBUG util.py:388: Error: No Package found for po4a [1] [1] https://kojipkgs.fedoraproject.org//work/tasks/5213/9525213/root.log