USN-5446-1: dpkg vulnerability

Releases

• Ubuntu 22.04 LTS
• Ubuntu 21.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• dpkg - Debian package management system

Details

Max Justicz discovered that dpkg incorrectly handled unpacking certain
source packages. If a user or an automated system were tricked into
unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial of
service or potentially gaining access to the system.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• dpkg - 1.21.1ubuntu2.1
• libdpkg-perl - 1.21.1ubuntu2.1

Ubuntu 21.10

• dpkg - 1.20.9ubuntu2.2
• libdpkg-perl - 1.20.9ubuntu2.2

Ubuntu 20.04

• dpkg - 1.19.7ubuntu3.2
• libdpkg-perl - 1.19.7ubuntu3.2

Ubuntu 18.04

• dpkg - 1.19.0.5ubuntu2.4
• libdpkg-perl - 1.19.0.5ubuntu2.4

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-1664

Related notices

• USN-5446-2: dpkg, libdpkg-dev, libdpkg-perl, dselect, dpkg-dev