CVE-2004-2768
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a...
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.
Exploit likelihood
What each source reports
NVD Score used
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.
- Record
CVE-2004-2768- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.
- Record
CVE-2004-2768- Updated
- 2026-11-02
EUVDEUVD-2004-2758 No score
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.
- Record
EUVD-2004-2758- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qrp8-65v4-pc63 No score
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a...
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.
- Record
GHSA-qrp8-65v4-pc63- Updated
- 2026-11-02
OSV No score
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.
- Record
CVE-2004-2768- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-2768 No score
dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.
- Record
DEBIAN-CVE-2004-2768- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-2768 is a high vulnerability (CVSS 7.2) in Debian Dpkg, published June 8, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in dpkg 1.10.19.
References
exchange.xforce.ibmcloud.com/vulnerabilities/59428
hackinglinuxexposed.com/articles/20031214.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=225692
lists.jammed.com/ISN/2003/12/0056.html
bugzilla.redhat.com/show_bug.cgi?id=598775
nvd.nist.gov/vuln/detail/CVE-2004-2768
github.com/advisories/GHSA-qrp8-65v4-pc63
security-tracker.debian.org/tracker/CVE-2004-2768