Cloudanix VulnDB

CVE-2015-0860

None

CVSS

—

EPSS

5.0%

Published

Dec 3, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in software that handles installation packages on certain Linux systems could let attackers take control of a computer by tricking it into opening a specially made package file.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Off-by-one error in extracthalf function in dpkg-deb allows remote attackers to trigger a stack-based buffer overflow via a crafted archive magic version number in an old-style Debian binary package, enabling arbitrary code execution.

Why it matters to the business

Attackers could compromise systems during package extraction or installation workflows, leading to unauthorized code execution, data breaches, or service disruption on affected Linux distributions.

How an attack unfolds

An attacker creates a malicious Debian package embedding an oversized or malformed magic version number that overflows the buffer in the vulnerable extracthalf function; when a victim system processes the package with dpkg-deb, the overflow allows shellcode injection and execution.

How to fix it

Upgrade dpkg to 1.16.17 or newer for the 1.16.x branch and to 1.17.26 or newer for the 1.17.x branch; rebuild or replace any affected packages with patched versions.

How to confirm the fix worked

Verify installed dpkg version meets or exceeds the fixed releases; attempt extraction of test packages containing boundary magic version numbers and confirm no overflow occurs.

Typical attack path

  1. Craft a Debian binary package with a malicious archive magic version number
  2. Distribute the package through repositories, downloads, or supply chain channels
  3. Victim invokes dpkg-deb to extract or inspect the package
  4. Buffer overflow triggers arbitrary code execution on the target system

How to detect it

Review system and dpkg logs for repeated or failed package extraction attempts; inspect for unexpected process crashes, new executable files, or shell activity immediately following dpkg-deb invocations on untrusted packages.

What your security team should do

  • Immediately update dpkg across all affected systems to the fixed releases
  • Audit package repositories and build pipelines for vulnerable dpkg versions
  • Restrict use of untrusted or old-style Debian packages until patches are applied
  • Monitor package management logs for anomalous extraction attempts

The record

Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 dpkg 0 1.18.4
Debian:12 dpkg 0 1.18.4
Debian:13 dpkg 0 1.18.4
Debian:7 dpkg 0 1.16.17
Debian:8 dpkg 0 1.17.26
Mageia:5 dpkg 0 1.17.26-1.mga5
SUSE:Linux Enterprise Desktop 12 SP1 update-alternatives 0 1.16.10-12.6.1
SUSE:Linux Enterprise Server 12 SP1 update-alternatives 0 1.16.10-12.6.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 update-alternatives 0 1.16.10-12.6.1
Ubuntu:14.04:LTS dpkg 0 1.17.5ubuntu5.5

Related vulnerabilities