CVE-2014-1833

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to...

5.0 MediumFix available

CVE-2014-1833 is a medium vulnerability (CVSS 5.0) in Devscripts Devel Team Devscripts, published February 5, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.73%, the 89th percentile. Fixed in devscripts 2.14.8.

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Exploit likelihood

3.73%Up 2.3 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Record: CVE-2014-1833
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Record: CVE-2014-1833
Updated: 2026-11-02

EUVDEUVD-2014-1903 No score

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Record: EUVD-2014-1903
Updated: 2026-11-03

GitHub AdvisoriesGHSA-69jm-8rf8-mqcr No score

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to...

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Record: GHSA-69jm-8rf8-mqcr
Weakness: CWE-22
Updated: 2026-11-02

OSV No score

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Record: CVE-2014-1833
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-1833 No score

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Record: DEBIAN-CVE-2014-1833
Updated: 2026-11-02

OSVSUSE-SU-2024:2621-1 No score

Security update for devscripts

This update for devscripts fixes the following issues:

CVE-2014-1833: Fixed symlink directory traversal in uupdate (bsc#861514)

Record: SUSE-SU-2024:2621-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-1833 No score

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Record: UBUNTU-CVE-2014-1833
Updated: 2026-11-02

OSVUSN-2649-1 No score

devscripts vulnerability

It was discovered that the uupdate tool incorrectly handled symlinks. If a user or automated system were tricked into processing specially crafted files, a remote attacker could possibly replace arbitrary files, leading to a privilege escalation.

Record: USN-2649-1
Updated: 2026-11-02

Affected products

devscripts devel team devscripts

Affected packages

Affected packages
Package	Affected	Fixed
`devscripts` Debian:12	before 2.14.8	2.14.8
`devscripts` Debian:13	before 2.14.8	2.14.8
`devscripts` Debian:14	before 2.14.8	2.14.8
`devscripts` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 2.12.6-5.3.1	2.12.6-5.3.1
`devscripts` Ubuntu:14.04:LTS	before 2.14.1ubuntu0.1, plus listed versions 2.13.42.13.4build12.13.8git12.13.92.14.1	2.14.1ubuntu0.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 11 moreShow less