CVE-2014-8625

Name	CVE-2014-8625
Description	Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)
Debian Bugs	768485

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dpkg (PTS)	jessie	1.17.27	fixed
	jessie (security)	1.17.26	fixed
	stretch	1.18.24	fixed
	buster, sid	1.19.0.5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
dpkg	source	(unstable)	1.17.22	unimportant	768485
dpkg	source	squeeze	(not affected)
dpkg	source	wheezy	1.16.16	medium

Notes

[squeeze] - dpkg <not-affected> (Regression introduced in 1.16.2)
Rendered non-exploitable by toolchain hardening
https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135
Regression introduced with https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=0b8652b226a7601dfd71471797d15168a7337242 (1.16.2)